What it asks for. Processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data used to identify a person, health data and data about sex life or sexual orientation, is prohibited unless one of the listed exceptions applies. Exceptions include explicit consent, employment and social protection obligations, vital interests and specific grounds set by law.
In practice. Organisations identify where special category data is processed, record both an Article 6 lawful basis and an Article 9 condition, and apply stronger controls such as restricted access, encryption and stricter retention. Evidence includes data inventories that flag these categories, DPIAs where required and documented reliance on any national law provisions.
Common gaps. Special category data often appears unexpectedly, for example in free text fields, sickness records or biometric access systems. Organisations also forget that member state law can add conditions.