Law on Personal Data Protection, special categories of data

Law on Personal Data Protection, arts. 9(7)-(9), 12-14 (special categories of data)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not process special categories of data, meaning data on racial or ethnic origin, political, religious or other beliefs, social origin, trade union membership, health, sex life or sexual orientation, biometric data, or criminal and misdemeanour records, unless one of the exceptions in Article 13 applies, starting with the data subject's consent.
Process a child's personal data in a manner that is in the best interest of the child, under Article 12.
Distinctively designate and protect special categories of data against unauthorised access, under Article 13.
Do not process personal data relating to criminal offences, criminal or misdemeanour penalties or security measures except by, or under the supervision of, the competent state authority, and only with the safeguards the law requires, under Article 14.

What it reaches

Obligation class

Consent, Prohibition, Biometric

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 9 defines special categories of data as personal data concerning racial or ethnic origin, political, religious or other beliefs, social origin, trade union membership, health, sex life or sexual orientation, biometric data, and data from registers of misdemeanour and criminal convictions, with biometric data itself defined generically, without enumerated examples, as data on physical or physiological features intrinsic to every natural person that are specific, unique and unchangeable and capable of revealing identity directly or indirectly.

Article 12 requires personal data concerning children to be processed in a manner that is in the best interest of the child.

Article 13 permits processing special categories of data only where the data subject has consented, where necessary for detecting, preventing or diagnosing illness or providing medical treatment by a health worker or another person under a professional secrecy duty, to protect the vital interests of the data subject or another person unable to consent, where the data subject has manifestly made the data public or processing is necessary to establish or protect a legal interest, or in the non-disclosed internal activities of a political, religious or other non-profit association, and requires special categories of data to be distinctively designated and protected against unauthorised access.

Article 14 confines the processing of personal data on criminal offences, criminal or misdemeanour penalties or security measures to the competent state authority or its supervision, with safeguards required by law.

When LexLint raises it

crawls_web
trains_models
processes_biometrics
serves_minors
handles_health_records

Read the law

70/09-consolidated English translation hosted by the Agency for Personal Data Protection and Free Access to Information (azlp.me)
read in full (54,193 characters, not truncated)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app