Special Category Data Classification — GDPR Art. 9

Overview

Article 9(1) of the GDPR establishes a general prohibition on processing special categories of personal data. These categories were identified by the European legislature as carrying heightened risk to fundamental rights and freedoms due to their potential for discrimination, social stigma, or irreversible harm. Processing is permitted only when one of the ten conditions in Art. 9(2)(a)-(j) is satisfied, in addition to a valid lawful basis under Art. 6. This skill provides a systematic framework for identifying special category data across enterprise systems and mapping each instance to an appropriate processing condition.

The Eight Special Categories — Art. 9(1)

Category 1: Racial or Ethnic Origin

Definition: Data revealing or from which racial or ethnic origin can be inferred, including direct declarations, photographs, names characteristic of particular ethnic groups, or nationality data when used as a proxy for ethnic origin.

Examples at Vanguard Financial Services:

• Employee self-identification forms for diversity monitoring
• Customer photographs in KYC documentation
• Nationality fields when used to infer ethnicity
• Language preference data when combined with geographic data to infer origin

Boundary Cases: