GDPR Article 9: Processing of Sensitive Data

What does Article 9 of the GDPR say about sensitive data?

Article 9 of the GDPR establishes a prohibition in principle on the processing of personal data known as "sensitive" data, meaning data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person's sex life and sexual orientation.

This same article nonetheless provides for limited exceptions: explicit consent of the data subject, obligations under employment law, protection of vital interests, activities of a non-profit foundation or association, data manifestly made public, the establishment of legal claims, substantial public interest, medical purposes, public health, or scientific research. Each exception must be documented and justified in the organisation's records of processing activities.

Best practices and how Data Comply One supports you

Identifying and mapping processing activities involving sensitive data is a fundamental step in GDPR compliance. It is recommended to precisely qualify each processing activity, document the legal basis retained from among the exceptions under Article 9, and implement enhanced security measures appropriate to the sensitivity of the data.

• Map sensitive data processing activities in your records.
• Document the applicable legal basis and associated security measures.
• Assess the need for a data protection impact assessment (DPIA) when such processing activities present a high risk.
• Train the relevant staff members on the specific rules governing this data.

Data Comply One centralises these steps within a guided interface, enabling your teams to manage the compliance of your sensitive processing activities in a structured and auditable way.