Sensitive data in German data protection law

Processing of special categories of personal data

Sec. 22(1) no. 1 BDSG allows the processing of special categories of personal data despite Art. 9 (1) GDPR, if it is necessary

  • to exercise the rights derived from the right of social security and social protection
  • for the purposes of preventive medicine, assessment of the working capacity of the employee, medical diagnosis, provision or treatment of health or social care, management of health or social care services, and if such data is processed by health professionals (or other persons subjected to professional secrecy obligation)
  • for reasons of public interest in the area of public health


Processing of special categories of personal data is also permitted in an employment context. For more details, see Data protection for employees”.

Derogations for public bodies

In accordance with Sec. 22(1) no. 2 BDSG, public bodies can process the special categories of data, when the processing is necessary:

  • for reasons of substantial public interest
  • to prevent a substantial threat to public security
  • to prevent harm to the common good or to safeguard concerns of the common good

for urgent reasons of defence or supra- or intergovernmental obligations of a public body in case of conflict management or humanitarian measures

Contact us!

Secure the knowledge of our experts!

Subscribe to our free newsletter: