Article 9 — Legal Bases for the Processing of Special Categories of Personal Data

Legal Provision

Legal bases for the processing of special categories of personal data: establish the specific additional conditions under which such processing is permitted.

Scope

Applies to the entities determining the purposes and means of the processing: data controllers.

Requirement type

Permission: provided that one of these conditions is met (in addition to the conditions in Article 6), the entity is ‘authorised’ to process special categories of personal data.

Actions to demonstrate compliance

A. Binary (yes/no)

Consent: signed consent form or record of ‘explicit’ consent by other means.
Necessity in employment law or social security and social protection law: specific law or collective agreement specified in privacy policy or other communication means provided by the employer.
Vital interests: documentation explaining why the individual could not give consent (e.g., unconscious or in danger) and why processing was necessary to protect life or safety.
Charities or non-profit bodies: documentation demonstrating that the data relates only to members or regular contacts, is used solely for internal purposes, and is never shared outside the organization.
Manifestly public data: stored proof that the individual intentionally made their sensitive data public (e.g., through a social media post or public statement).
Legal claims: keep records (documentation) linking the use of the data to a legal dispute or court proceeding (e.g., lawsuit files, legal correspondence).
Substantial public interest: reference in the privacy policy to the specific law that justifies the processing.
Medical care and health services: record of the contract or legal basis authorizing a doctor or health provider to process the data.
Public health protection: reference in the privacy policy or similar documents to the specific law that permits processing for public health purposes (e.g., pandemic response), along with a list of measures taken to protect privacy.
Research and public archives: reference in the privacy policy or privacy notice to the specific law that enables the processing.

B. Non-binary (require a contextual assessment)

Consent: consent must be explicit, freely given, specific, informed, unambiguous and easily withdrawable.
Necessity in employment law or social security and social protection law: the EU law, national law or a collective agreement must provide appropriate safeguards for the data subject.
Vital interests: demonstration of urgency and impossibility to recur to other legal bases.
Charities or non-profit bodies: demonstration that data are only used for core activities, stay confidential, and that staff or volunteers follow strict access rules.
Manifestly public data: proof and assessment that the person clearly intended to make their data public, not just shared it by accident or without understanding.
Legal claims: demonstration that data are strictly necessary for the legal case and limited to what is relevant for defending or asserting the claim.
Substantial public interest: the referenced law includes clear safeguards, such as limits on access, logging, and strong protections for the people affected.
Medical care and health services: demonstration that data are used only by licensed professionals or care providers and only for treatment or managing the health system.
Public health protection: demonstration that requested data use supports a real public health goal and is done under legal rules with clear privacy controls.
Research and public archives: demonstration that the project uses as little data as possible, applies techniques like pseudonymization, and limits access to only those who need it.

Monitoring requirement

Verification of stored documentation to confirm that the conditions are met, including:
a. Verification that consent has not been withdrawn, the healthcare contract/service framework is still in place, or documentation exists that justifies legal proceedings.b. Confirmation that the ‘enabling laws’ remain in force and are applicable.