The GDPR distinguishes between two types of personal data. Regular personal data which have been defined in Chapter 2.2 and special categories of personal data. The latter category is also referred to as sensitive personal data; both designations are correct.
In this chapter, you will discover the differences between the two types of personal data and what these differences mean within the area of research.
 

What kind of data are we talking about?


Special categories of personal data are personal data that say something about a person’s:

  • Racial or ethnic origin
  • Political opinions
  • Religious or philosophical beliefs
  • Trade union membership
  • Genetic or biometric status for the purpose of unique identification
  • Health
  • Sexual orientation
  • Criminal history

If a researcher wishes to process regular personal data in the context of research, this is permitted provided there is a legal basis for this and sufficient technical and organisational measures have been taken to protect the personal data as effectively as possible (the bases and measures are discussed in greater detail in Chapter 3: GDPR). However, the processing of special categories of personal data is, in principle, prohibited (Article 9.1 GDPR):

Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.

However, there are certain exceptions for scientific research. On the next page, you will discover what these exceptions are.