Health, religion, union membership: special category data in documents
GDPR Articles 9 and 10 define special category data. See where it hides in HR files, payslips and court papers, and how to mask it correctly.
Special category data is the most sensitive kind of personal data under the GDPR. It includes health, religion, political views and union membership. It hides in ordinary paperwork: a payslip, a sick note, a witness statement. This guide shows where it hides and how to mask it properly.
It slips just as easily into a scanned form, an email thread or a shared spreadsheet. A single sentence can be enough to reveal it.
What counts as special category data?
Article 9 of the GDPR lists nine special categories. Processing personal data in any of them is banned by default, unless an exception applies, such as explicit consent or a duty under employment law.
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic data
- Biometric data (used to identify someone)
- Health data
- Sex life
- Sexual orientation
Article 10 covers a tenth kind of data: criminal convictions and offences. The GDPR treats it separately from Article 9, but almost as strictly. The text reserves this processing to official authority, unless EU or national law allows it. A criminal record extract, such as a DBS check in the UK, falls under this stricter regime.
This split matters in practice. The safeguards and the exceptions for Article 10 are not identical to the ones for Article 9. Treating the two lists as one can lead you to the wrong justification.
Where does special category data hide in documents?
This kind of data does not stay in a health record. It slips into ordinary business paperwork, often next to a name or an employee number. Once it is on paper or in a PDF, it travels every time the file is shared.
| Document | Where it appears | What to do |
|---|---|---|
| HR personnel file | A sick note or a disability accommodation request | Mask the medical detail itself, not only the employee's name |
| Payslip | A trade union dues deduction line | Mask the whole line, not just the amount |
| Expense report | A receipt tied to a religious holiday or a specific diet | Mask the merchant name and the description together |
| Witness statement or court exhibit | A mention of a party's health, religion or sexual orientation | Mask the sentence, not only the person's name |
Why do pattern detectors miss it?
A detector for an IBAN or an email address looks for a fixed pattern of letters and numbers. Health data and religion do not work that way. They are ordinary words that only become sensitive because of what they say, in that sentence, about that person.
A phone number detector will never flag the word chemotherapy sitting two lines above it. No fixed pattern connects a diagnosis to the person it describes, so the connection has to be read, not scanned.
How do you minimise special category data properly?
Minimising special category data means removing the whole passage, not just the person's name. Take Jane Example, whose personnel file has a note: 'Jane requested Friday afternoons off for religious observance.' Blacking out 'Jane' leaves the sensitive fact fully readable. Mask the whole sentence instead.
- Read the whole sentence or field before you decide what to mask.
- Mask the fact itself: the diagnosis, the belief, the union name, not only the person's name next to it.
- Check nearby fields too: a job title, a department, or a photo can point to the same fact.
- When in doubt, remove the passage rather than guess how sensitive it is.
ONYRI Sanitize has no detector for medical terms, religious words or union names. These depend on context, not a pattern, so no scanner catches them well. Its detectors still catch the identifiers sitting next to them, such as names, ID numbers, addresses and dates. To mask the sensitive words themselves, add them with the Also mask list or a custom rule, then check the preview before you download.
Who needs to know, when you share this data?
Need-to-know is the rule once special category data must move. A doctor, an insurer or a court may need one fact from a file, not the whole document. Send only what answers their specific question.
Sending the complete file because it feels faster only adds risk. Every extra page is one more place where a fact reaches someone who did not need it.
| Recipient | What they need | What to leave out |
|---|---|---|
| Occupational doctor | Fitness for one specific task | Full diagnosis history unrelated to that task |
| Insurer handling a claim | Facts tied to the claim itself | Unrelated medical or lifestyle details |
| Court or opposing counsel | Facts that are actually at issue in the case | A witness's religion, health or union status, if it is not at issue |
Masking a name is not enough for this kind of data. The context around it carries the real risk. Read every sentence before you send a document, and take out a fact completely when it is not needed.
Build this check into your routine, especially for HR, legal and insurance files that move between teams often. A habit costs a minute. A leaked diagnosis or a disclosed union card does not undo itself.
Frequently asked questions
Is a sick note or medical certificate special category data?
Yes. A sick note reveals something about a person's health, which Article 9 of the GDPR protects. Mask the reason for the absence, not only the employee's name.
Does a birthplace on a form reveal ethnic origin?
Not on its own. German data protection guidance treats a birthplace alone as ordinary data. It only becomes sensitive when combined with other clues that point to origin. Several small clues together can still add up to a risk.
Can I process special category data with someone's consent?
Yes, explicit consent is one of the exceptions in Article 9(2) GDPR. In an employment file, a specific law or a collective agreement is often the real basis instead.
Is a criminal record extract the same as special category data?
No. Article 10 GDPR covers convictions and offences separately, under similarly strict rules. A DBS check or a police clearance certificate both fall under this stricter regime, so treat it with the same care.
Does removing the name make a sensitive sentence safe to share?
No. The fact itself, such as a diagnosis or a religious practice, still identifies the person to anyone who knows the context. Mask the whole sentence instead.
Sources & references
- Regulation (EU) 2016/679 (GDPR): Articles 4, 9 and 10EUR-Lex
- What is special category data?Information Commissioner's Office (ICO)
- Kurzpapier Nr. 17: Besondere Kategorien personenbezogener Daten (27 March 2018, in German)Datenschutzkonferenz (DSK)
- Définition : donnée sensible (in French)CNIL