A sub-category of personal data that requires heightened data protection measures due to its sensitive and personal nature. In some jurisdictions, this type of personal data may be described as sensitive personal data. Controllers or data owners typically must satisfy certain requirements before processing special categories of data, such as obtaining data subject consent.

The term may have specific meanings in different jurisdictions. Under the General Data Protection Regulation (GDPR), for example, special category data includes data that reveals a data subject's:

(Article 9(1), GDPR.)

At least one condition listed in GDPR Article 9(2) must be met to process special categories of data.

The EU Court of Justice (ECJ) has ruled that processing personal data liable to indirectly reveal sensitive information concerning an individual is prohibited under the GDPR unless an Article 9(2) condition applies, highlighting how broadly special categories of personal data are defined (Case C-184/20: OT v Vyriausioji tarnybinės etikos komisija (Chief Official Ethics Commission, Lithuania); Legal update, Information indirectly disclosing sexual orientation is special category personal data (ECJ)).

For more on processing special categories of personal data, see Practice note, Overview of EU General Data Protection Regulation: Special Categories of Personal Data.