Data protection

Special category data: what counts, and what holding it changes

The GDPR forbids using nine kinds of personal data unless one of ten conditions applies. A clinic's notes, a gym's health questionnaire and a recruiter's diversity form are all among them, and holding any of them changes which of the GDPR's lighter rules for small businesses still apply.

By Oscar CobbeCurrent as at 29 October 20262 minute read3 sources

The nine kinds

Article 9(1) lists them. Using any of these is prohibited unless a condition in Article 9(2) applies:

1Racial or ethnic origin.
2Political opinions.
3Religious or philosophical beliefs.
4Trade union membership.
5Genetic data.
6Biometric data used to identify a person uniquely, such as a fingerprint used to clock in.
7Data concerning health, which Article 4(15) defines as data about a person's physical or mental health, including the health care they receive.
8Data concerning a person's sex life.
9Data concerning a person's sexual orientation.

The conditions a small business is likely to use

Article 9(2) lists ten. Four come up in ordinary business:

1(a) Explicit consent for one or more specified purposes, given by the person themselves; Irish or EU law can rule it out for some uses.
2(b) Obligations and rights in employment and social security law, as far as that law authorises it, such as sick leave records.
3(f) Establishing, exercising or defending legal claims.
4(h) Health or social care, medical diagnosis, treatment, or assessing an employee's working capacity, on the basis of law or under contract with a health professional and subject to professional secrecy.

You still need an ordinary lawful basis too

An Article 9 condition lifts the ban on special category data. It does not replace the lawful basis every use of personal data needs under Article 6. The Data Protection Commission's guidance on legal bases says such processing needs both.

What it changes for a small business

Three of the GDPR's lighter rules for small organisations stop applying, or come closer, once special category data is involved.

Duty	What the GDPR says
A record of processing	Article 30(5) excuses organisations with fewer than 250 people, but not where the processing includes special category data. A practice that holds patient notes keeps a record whatever its size.
An impact assessment (DPIA)	Article 35(3)(b) requires one for processing special category data on a large scale.
A data protection officer	Article 37(1)(c) requires one where the core activities consist of processing special category data on a large scale.

Where to go next

The record is the first thing to put right: what a record of processing has to contain. Whether your use is on the Data Protection Commission's list of those that need an impact assessment is a question the free DPIA check answers, and whether you need a DPO turns on what "large scale" means for you.

Health research has its own Irish regulations on top of the GDPR, covered in the Health Research Regulations.

Sources

Free, and no account needed

Does what you hold need a DPIA?

Nine questions against the Data Protection Commission's list of uses that need an impact assessment, health data among them. The result prints as your record of the screening.

Run the free check

The GDPR pack, €650 once

For practices that hold health details: the written record of what you hold and why, a privacy notice that matches your website, and the steps for when someone asks for their data or something goes wrong.

See the prices

Who wrote this

Oscar Cobbe · Founder, FourWinds Digital

Writes and maintains the legal explainers on this site, and does the compliance work behind them. Every date and article number here is checked against the legislation itself before it is published, and each article shows the date it was last checked.

More about how we work →