Rules
Which data the law treats as special, why processing is prohibited unless an exception applies, and what that means for client files in an AI chatbot.
Special category data is personal data so sensitive that the GDPR prohibits processing it unless a statutory exception applies. It covers data revealing someone's ethnic origin, political opinions, religion or trade union membership, and data concerning health, sex life or sexual orientation, genetic data and biometric data for identification.
The law itself says “special categories of personal data”. The list is in Article 9(1) GDPR and is exhaustive: anything not listed is not special category data, however sensitive it feels. The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, explains on its page what is personal data why the category exists: the data is so sensitive that processing may have major consequences for someone. This article is an explanation, not legal advice. Assess whether an exception applies to your situation with your data protection officer or a lawyer.
Article 9(1) names eight types.
For the first four types, the statutory text refers to data “revealing” something. The data therefore need not be in a labelled field. A sentence in meeting notes from which you can infer someone's religion or trade union membership is covered.
The definition in Article 4 includes physical and mental health data and data about healthcare services provided that reveals information about someone's health status. A sickness notification or referral may therefore be health data.
More often than you think, and rarely where you expect it. The table gives a fictional example per category and the documents in which firms encounter it. The final two rows are not special category data but are often confused with it.
| Category | Example | Where it appears in files |
|---|---|---|
| Health | “Has been at home with burnout since March” | Absence file, email to a manager, personal injury file, insurance application |
| Racial or ethnic origin | Parents' country of birth on an intake form | Personnel file, client file, application form |
| Political opinions | “Represents a party on the municipal council” | CV, application letter, note about outside positions |
| Religion or philosophical beliefs | Request for leave for a religious holiday | Leave request, meeting notes, membership list |
| Trade union membership | Membership dues deducted on a payslip | Payroll records, report of a reorganisation meeting |
| Genetic data | Result of a hereditary conditions test | Medical record, insurer's file |
| Biometric data for identification | Fingerprint for access to a building | Access system, time recording, facial recognition sign-in |
| Sex life or sexual orientation | Comment about someone's orientation in a complaint about treatment | Complaints file, confidential adviser's report, family law file |
| Criminal offence data (not special category data) | Report of theft by an employee | Dismissal file, claims file, screening |
| BSN (not special category data) | Number on a payslip | Payroll records, identity document copy, policy schedule |
An absence file contains a name, BSN and health data. The most sensitive type in the document determines what you must arrange for the whole document.
For ordinary personal data, the question is whether you have a lawful basis. For special category data, the law reverses this: Article 9(1) prohibits processing, and paragraph 2 lists when the prohibition does not apply.
You therefore need two things. On its page GDPR lawful bases explained, the AP says processing is prohibited unless you can rely on an exception, and you additionally need one of the lawful bases for ordinary personal data.
The reason is risk. For data breaches, the AP lists discrimination as possible harm from leaked data about ethnic origin, religion or sexual orientation. The law also weighs more heavily elsewhere: large-scale processing requires a DPIA (Article 35), and for a data breach the AP says you should in any event take a high risk into account. See What is a data breach?.
Article 9(2) contains ten exceptions. According to the AP, five apply only when national legislation provides a basis. In summary:
Consent must be explicit, for a specified purpose, and may be withdrawn. You then no longer have an exception. Do not build a work process on consent if another exception fits.
A doctor may process health data for treatment, a lawyer for litigation. That says nothing yet about what may happen to that data afterwards. Processing the same data for another purpose or with another tool calls for a fresh test: is this necessary for that purpose?
The Netherlands has elaborated the exceptions in Articles 22 to 30 of the Dutch GDPR Implementation Act (text effective from 1 September 2026). Article 22 repeats the prohibition. Provisions for each data type follow.
The Act also contains Article 23a on mandatory accounting engagements; according to the text on wetten.overheid.nl, that provision had not yet entered into force on 13 October 2026.
Article 30 specifies when the prohibition does not apply for each type of organisation.
An often-forgotten condition accompanies this. Under paragraph 4, data is processed only by people bound to secrecy by office, profession, statutory provision or agreement.
On its page about biometrics, the AP points out that confirming someone's identity with biometric data falls under the same rules as identification.
According to the AP, criminal offence data and the BSN are not special category data within the GDPR's meaning. Both do have special rules.
Article 10 GDPR provides that personal data concerning criminal convictions and offences may be processed only under official authority or where legislation permits. According to the AP, this may also include well-founded suspicions: concrete indications that someone committed an offence.
The Dutch GDPR Implementation Act elaborates this in Articles 31 to 33. Article 32 contains general grounds such as explicit consent and legal claims. Article 33 contains specific grounds: an organisation may, for example, process criminal offence data to protect its own interests regarding offences committed, or expected to be committed, against it or its staff.
Since 1 September 2026, Article 33 includes a fifth paragraph: criminal offence data may be processed where necessary for an engagement an accountant performs under a statutory provision. The AP mentions this exception on its lawful bases page.
Article 87 GDPR leaves national identification number rules to member states. Article 46 of the Dutch GDPR Implementation Act is brief: a number prescribed by law to identify someone is used only to implement that law or for purposes specified by law. The AP summarises this on its BSN page: non-governmental organisations may use the BSN only where provided by law, such as in healthcare and education.
A dietary preference, absence on Friday afternoon, membership of a patient association: you can infer something from them. How far this extends with indirect indications is a legal question the statutory text does not answer in detail. In practice, assume data from which you can reasonably infer a special characteristic deserves stricter treatment, and ask a lawyer if in doubt.
A photograph is not automatically special category data. Recital 51 GDPR says processing photographs should not systematically be considered processing special categories: photographs fall within the definition of biometric data only when processed through technical means allowing unique identification or authentication. A passport photograph in a personnel file therefore generally counts as ordinary personal data. The same photograph in a facial recognition system does not.
According to the AP, financial, location and communications data are sensitive but not special category data. The Article 9 prohibition does not apply; they do carry significant weight for security and in a data breach.
“We have a contract with the client” is a lawful basis under Article 6. It is not an exception under Article 9. Anyone processing a client's health data needs both.
The exception covers a purpose. A new system or recipient requires a fresh assessment, an entry in the record of processing activities and often a DPIA.
The question is whether your organisation may process the data using that system. You need the same things: a lawful basis and an exception, for this purpose and with this recipient.
Pasting an absence file into a chat window for a summary discloses health data to that chatbot's provider. The reintegration exception was written for supporting the employee. Whether it also covers sending the file to a general AI service is a question of necessity.
The AP warned in 2024 after data breach notifications, including a general practice where an employee entered patients' medical data into an AI chatbot contrary to the rules.
What you must arrange for each data type before putting it in a chatbot is in client data in an AI chatbot: rules for each type of data. For professions with a confidentiality duty, professional secrecy applies as well; see professional secrecy and AI.
Article 22(4) GDPR is strict on fully automated decisions: they may not be based on special categories unless there is explicit consent or a substantial public interest based on legislation, with appropriate measures. Anyone using AI to select or assess people encounters this.
PrivaSearch is designed for step 3. Personal data such as names, addresses, BSNs, IBANs, vehicle registration numbers and dates of birth is detected within PrivaSearch and replaced with pseudonyms. A colleague then sees the original alongside the pseudonymised text, fills in what the model missed and approves it. Only then is a document searchable. The steps are on how PrivaSearch works.
One thing is important to understand for special category data. Pseudonymisation removes who a sentence concerns, not what it says. “Is at home with burnout” remains, linked to a pseudonym rather than a name. For your organisation, that remains health data: the exception to the prohibition, lawful basis and DPIA remain your responsibility. An indirectly identifiable detail needs an attentive reviewer; the review is therefore mandatory.
A connected assistant receives only released, pseudonymised passages and no original files, filenames or links. You can connect Claude, ChatGPT Business and Mistral Vibe (formerly Le Chat). Anything you type into the assistant goes directly to its provider: do not type names there. More is on ChatGPT, Claude, Mistral Vibe and the GDPR.
Your environment creates starter documents, including a DPIA starter document and the written lawful basis with the exception relied on for special categories. It is not legal advice; see GDPR and EU AI Act. To see it with your own type of file, book a demo.
Special category data is data revealing someone's racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and also genetic data, biometric data for unique identification, health data and data concerning sex life or sexual orientation. Processing is prohibited unless a statutory exception applies.
No. The BSN is not on the GDPR's list. Separate rules do apply: a number prescribed by law to identify someone may be used in the Netherlands only to implement that law or for purposes specified by law. Non-governmental organisations may therefore use the BSN only where legislation provides for it.
No, but it is treated with similar strictness. Data about convictions and offences, and according to the supervisory authority also well-founded suspicions, may be processed only under official authority or where legislation permits. In the Netherlands, the Dutch GDPR Implementation Act specifies the cases. You also need an ordinary lawful basis.
Not automatically. A photograph is personal data if someone can be recognised in it. It becomes special category data only when processed with technical means to identify someone uniquely or confirm their identity, such as facial recognition. It is then biometric data. A passport photograph in a personnel file does not fall within this.
Only insofar as legislation permits. The Dutch GDPR Implementation Act lists schemes with entitlements depending on health status and reintegration or support during illness or incapacity for work. Processing must be necessary for that and performed by people bound to confidentiality. What exactly may be recorded needs assessing in each situation.
Generally not. You need a lawful basis and a statutory exception also covering disclosure to the chatbot's provider, and one rarely exists for “just summarising”. A free or personal account also lacks a data processing agreement. Have a lawyer or your data protection officer assess whether an exception exists in your case.
The AI Act timeline after the digital omnibus: what applies already, what has moved to 2027 and 2028, and what AI chatbot users need to arrange now.
What a deepfake is, which rules apply now, which prohibition is coming and how organisations tackle fraud using a fabricated voice or video.
What the Dutch Algorithm Register and IAMA are, what is mandatory and what is not, and what a municipality arranges when staff use AI chatbots.
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →