Special Category Basis
https://publicschema.org/vocab/special-category-basis
The explicit legal ground for processing special-category personal data (sensitive categories such as health, biometric, or ethnic-origin data) under GDPR Article 9(2) and equivalent national provisions. Processing special-category data requires both a standard legal basis from legal-basis and one of these additional grounds. Ten values correspond to GDPR Article 9(2)(a) through (j).
Aligned standards
| Standard | Equivalent | Match |
|---|---|---|
| DPV GDPR extension v2 | GDPR Article 9 - Processing of special categories of personal data | exact |
| The ten values of this vocabulary map one-to-one to GDPR Article 9(2)(a) through Article 9(2)(j). See individual value notes for per-value URIs. | ||
Values
| Code | Label | Standard code | Definition |
|---|---|---|---|
explicit_consent | Explicit consent | The data subject has given explicit consent to the processing of their special-category data for one or more specific purposes. Explicit consent requires more than a general tick-box; it must be a clear affirmative act, written or biometric, specifically addressing the special-category data. DPV GDPR mapping, GDPR Article 9(2)(a), dpv-gdpr:A9-2-a. | |
employment_social_security | Employment and social security | Processing is necessary for obligations and rights in employment, social security, or social protection law, to the extent authorised by national law providing appropriate safeguards. Applies when a national social protection law explicitly authorises the processing of, for example, disability or health data for benefit determination. DPV GDPR mapping, GDPR Article 9(2)(b), dpv-gdpr:A9-2-b. | |
vital_interests | Vital interests | Processing is necessary to protect the vital interests of the data subject or another person where the subject is physically or legally incapable of giving consent, such as in humanitarian emergency response. The scope is narrow; it does not apply to routine program delivery. DPV GDPR mapping, GDPR Article 9(2)(c), dpv-gdpr:A9-2-c. | |
non_profit_body | Non-profit body | Processing is carried out in the course of legitimate activities by a foundation, association, or other not-for-profit body with a political, philosophical, religious, or trade-union aim, and the processing relates solely to members or former members, or persons in regular contact in connection with those purposes. DPV GDPR mapping, GDPR Article 9(2)(d), dpv-gdpr:A9-2-d. | |
publicly_disclosed | Manifestly made public | Processing relates to data that has been manifestly made public by the data subject themselves. Only applies when the subject themselves chose to make the data public; it does not apply when data was disclosed by a third party or collected from a public source. DPV GDPR mapping, GDPR Article 9(2)(e), dpv-gdpr:A9-2-e. | |
legal_claims | Legal claims | Processing is necessary for the establishment, exercise, or defence of legal claims, or when courts act in their judicial capacity. Applies when a program must process special-category data to defend itself in a legal dispute or to enforce a legal obligation. DPV GDPR mapping, GDPR Article 9(2)(f), dpv-gdpr:A9-2-f. | |
substantial_public_interest | Substantial public interest | Processing is necessary for reasons of substantial public interest, on the basis of a specific national or EU law, with appropriate safeguards. Used for social protection programs where national law explicitly authorises processing of sensitive data such as disability status or ethnic origin for targeting or inclusion. DPV GDPR mapping, GDPR Article 9(2)(g), dpv-gdpr:A9-2-g. | |
preventive_health | Preventive or occupational medicine | Processing is necessary for the purposes of preventive or occupational medicine, assessment of the working capacity of the employee, medical diagnosis, provision of health or social care, or management of health or social care systems. Requires a health professional bound by professional secrecy or equivalent obligation. DPV GDPR mapping, GDPR Article 9(2)(h), dpv-gdpr:A9-2-h. | |
public_health | Public health | Processing is necessary for reasons of public interest in the area of public health, such as protection against serious cross-border health threats or ensuring high standards of quality and safety of health care and medicinal products, on the basis of national law providing appropriate safeguards. DPV GDPR mapping, GDPR Article 9(2)(i), dpv-gdpr:A9-2-i. | |
archiving_research | Archiving, research, or statistics | Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, in accordance with national law subject to appropriate safeguards for the rights and freedoms of the data subject. Used for program evaluations, longitudinal studies, and anonymised reporting. DPV GDPR mapping, GDPR Article 9(2)(j), dpv-gdpr:A9-2-j. |
Referenced by this vocabulary
- W3C DPV v2 W3C Data Privacy Vocabularies and Controls Community Group (DPVCG), 2024
Other references
- GDPR Article 9 - Processing of special categories of personal data superset Article 9(2)(a) through (j) define the ten grounds. Equivalent provisions exist in Kenya DPA 2019 s.45(1), South Africa POPIA s.27(1), Brazil LGPD Art.11.