Special categories of personal data

Some personal data creates a higher risk of discrimination or serious harm if misused, so the law protects it more strongly. Under GDPR Art. 9, processing these special categories is prohibited unless one of a closed list of exceptions applies, such as explicit consent, employment and social security obligations, vital interests or substantial public interest. The LGPD calls them dados pessoais sensíveis (Art. 5, II) and lists its own lawful bases in Art. 11, which notably exclude legitimate interest.

The category also covers inferences. A model that infers health conditions from purchase history, or sexual orientation from social media activity, produces sensitive data even if none was collected directly. Biometric data counts when it is processed to uniquely identify a person.

In practice, special categories usually trigger a DPIA, stricter access controls and careful bias analysis, because protected attributes are exactly where algorithmic discrimination appears. A recruitment tool that scores video interviews using facial analysis is a typical high-risk example.