Art.9 Processing of special categories of personal data
Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, nor genetic data, biometric data processed to uniquely identify a person,
5
artefacts
1
held by a system
0
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Explicit consent records showing the consent was explicit and specific to the special category processing · Data governance / DLP tooling
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- An inventory identifying where special category data is held, including where it is inferred rather than collected · Policy repository / GRC workspace
- The Article 9(2) condition recorded per activity alongside its separate Article 6 basis · Document repository
- The Union or Member State law relied on where the condition requires one, cited to the provision · Document repository
- Professional secrecy or equivalent confidentiality obligations evidenced for staff handling health data under point (h) · Document repository
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Data governance / DLP tooling on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Special category data inferred from behaviour, purchases or free text and never recognised as in scope
- An Article 6 basis recorded with no Article 9 condition, or the two conflated into a single entry
- Explicit consent asserted from the same tick box used for ordinary consent
- Substantial public interest claimed without identifying the Union or Member State law that authorises it
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.8 Conditions applicable to child's consent · Art.10 Processing of personal data relating to criminal convictions