Special types of personal data | Data Privacy Handbook (2025)

Special categories of personal data

The GDPR explicitly defines eight “special categories of personal data”.Personal data of these types are extra sensitive, because they can be used todiscriminate or exclude people. The following types of personal data are definedas “special categories”:

• racial or ethnic origin (e.g., this could also be a combination of name andcountry of origin, but not necessarily pictures or videos)
• political opinions (in the broadest sense, not only membership of apolitical party)
• religious or philosophical beliefs (this does not have to be an “official”religion)
• trade union membership
• genetic data (e.g., DNA,rec. 34)
• biometric data, but only when meant to uniquely identify someone (e.g.,fingerprints, iris scans)
• data about physical or mental health in the broadest sense (includingindications, diagnoses and treatments,rec. 35)
• sex life or sexual orientation (including gender identity)

It is in principle prohibited to process these types of personal data,unless an exception applies(art. 9).For research, the following exceptions to this prohibition are the mostrelevant:

• Data subjects have made the data publicly available themselves

  You can use special categories of personal data when data subjects havemade those data publicly available themselves. It must concern truly publicsources (e.g., TV, newpaper, public social media, blogs, etc.) where the datasubject does not expect (some) privacy. Moreover, the data subject must haveintended to disclose the personal data “as special categories of personaldata”.

  An example: if someone writes in their blog that they have been voting fora certain political party all their life, they are consciously making thatinformation public. If someone is confined to a wheelchair and posts a holidayselfie (with a wheelchair) on a social medium, it is not about theirdisability, but about their holiday. Special category personal data derivedfrom this are still protected by the processing ban. The same applies, forexample, to personal data that can be derived from combining various separatedata sources.

  See Also

  Artikel 9 📖 DSGVO. Verarbeitung besonderer Kategorien personenbezogener Daten | GDPR-Text.com

  Publicly accessible special personal data of well-known personalities(celebrities, politicians, etc.) may be processed, whether those data havebeen made public by the person in question or by someone else.

• Data subjects have provided explicit consent to processthese data for a specific purpose

  If data subjects have provided explicit consent which satisfies the GDPRcriteria for valid consent, then you can use thepersonal data in your research project.

• Processing is necessary for scientific research purposesand consent is impossible or unreasonably difficult

  If you are using the special categories for scientific research purposes(incl.historical and statistical purposes), and it is impossible or wouldtake an unreasonable amount of effort to obtain explicit consent(UAVG art. 24),you can use the data in your research. If this is the case, you mustsubstantiate this danger to your project and take additional protectionmeasures. Obtaining consent could take an unreasonable amount of effort,for example, in:

  • large-scale archival research into living people from whom you cannotobtain all or up-to-date contact details
  • webscraping or other big data research, in which the time investment toobtain consent is out of proportion
  • fieldwork outside Europe. In many non-European communities, placing asignature on a consent form is not trusted. Sometimes people also havevery poor reading skills. Proving consent is then virtually impossible
  • research within more or less private social media groups.

Even if you can invoke one of these exemptions, special categories of personaldata warrant additional security measures to make sure they are protected.Always contact your privacy officer if you intend on usingthese types of data.

The Dutch Code of Conduct for Health Research(p.68) specifies a number of exceptions for health researchers in which explicitconsent for processing special categories of personal data may not be necessary.

Data that are otherwise sensitive

Other types of data can also be sensitive, because they can carry higher risksfor the data subjects. These types of data can either not be processed at all,or only under certain circumstances. Either way, they require additionalsecurity measures. Always contact your privacy officerif you intend on using these types of data.

Examples are:

• Financial data
• Data about relationship problems
• Data that can be misused for identity fraud, such as the Dutch CitizenService Number (BSN). The BSN can only be used when legally necessary. Sincethis is not the case for scientific research, using BSN in research is in mostcases forbidden.
• Criminal data or data about criminal convictions. These can only be processedunder governmental supervision or when a derogation exists in nationallegislation (art. 10).For scientific research, more or less the same regime applies for these dataas for special categories of personal data. This means that you are allowedto use them for your study if one of the exceptions mentioned for specialcategories of personal data applies.