Article 10 of the GDPR: Processing of Personal Data Relating to Criminal Convictions and Offenses
·
Updated on ·
By 
Bertrand Bucelle · 2 min read
Article 10 of the GDPR Explained
The processing of such data is only permitted if:
- It is carried out under the control of a public authority;
- Or if it is expressly authorised by Union or Member State law, subject to appropriate safeguards for the rights and freedoms of data subjects.
Article 10 applies in particular to processing operations concerning criminal convictions, serious administrative sanctions or data relating to criminal offences.
Why this article is important for your GDPR compliance
This type of data presents an increased risk to the fundamental rights of individuals. Article 10 therefore imposes enhanced protection, and strictly limits the cases where such data may be processed, particularly in a professional context (recruitment, background checks, etc.).
Application Examples of Article 10 of the GDPR
- A private security company may request a criminal record extract, only if provided for by national law.
- A public body that investigates administrative sanctions must strictly regulate the access to and use of this data.
- A recruiter may not demand criminal information without an explicit legal basis and justified by the nature of the position.
Related Resources
Accelerate Your Compliance in a Few Clicks
- Automate your compliance with our GDPR software
- Supported or outsourced by our DPO experts
- Train your teams with our GDPR e-learning training
👉 Request a demo with an expert
⚡ Assess your situation in 15 minutes with our free and no-obligation GDPR self-assessment:
How to Comply with GDPR Article 10?