Can we use AI on sensitive data such as health and religion?
Short answer
Special category data – health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, sex life and sexual orientation – may only be processed on a specific basis under Article 9 GDPR, such as explicit consent, employment law obligations or healthcare. When AI is involved, it is especially important to limit it: never send sensitive data together with a name to an AI service. Criminal convictions and offences have their own rules (Article 10), and national ID numbers can be subject to extra national rules (Article 87).
The special categories
| Category | Example that turns up in free text |
|---|---|
| Health | Sick leave, allergy, stress, pregnancy, disability |
| Racial or ethnic origin | – (origin or nationality alone is not necessarily sensitive) |
| Political opinions | Membership of a party |
| Religious or philosophical beliefs | Dietary requests, religious holidays |
| Trade union membership | Union dues deducted from pay, union rep role |
| Genetic and biometric data | Fingerprints, facial recognition |
| Sex life and sexual orientation | – |
How it looks with GoalCube
The AI gets [PERSON_1] and what the task needs – but never a name and health data together. Gender is written neutrally so it cannot affect the assessment.
| Customer | Location | Topic | |
|---|---|---|---|
| Sarah Murphy | sarah.murphy@example.com | Cork | Refund |
| Daniel Kelly | daniel.kelly@example.com | Galway | Delivery |
| Claire Walsh | claire.walsh@example.com | Limerick | Complaint |
| Thomas Camilleri | thomas.camilleri@example.com | Sliema | Delivery |
| Emma Byrne | emma.byrne@example.com | Dublin | Refund |
Enquiry Hi, my name is Sarah Murphy and I returned order 7012345678 two weeks ago, but I still haven't received my money. Please transfer it to IE29 AIBK 9311 5212 3456 78. Kind regards, Sarah
| Customer | Location | Topic | |
|---|---|---|---|
| [PERSON_1] | [EMAIL_1] | [STED] | Refund |
| [PERSON_2] | [EMAIL_2] | [STED] | Delivery |
| [PERSON_3] | [EMAIL_3] | [STED] | Complaint |
| [PERSON_4] | [EMAIL_4] | [STED] | Delivery |
| [PERSON_5] | [EMAIL_5] | [STED] | Refund |
Enquiry Hi, my name is [PERSON_1] and I returned order [ID_1] two weeks ago, but I still haven't received my money. Please transfer it to [IBAN_1]. Kind regards, [PERSON_1]
Sarah Murphy and Emma Byrne are waiting for a refund and should get a reply today. Thomas Camilleri has waited 10 days for a parcel. Suggested reply to Sarah Murphy: "Dear Sarah Murphy, thank you for your patience. Your money is on its way and will be in your account within 5 working days."
[PERSON_1] and [PERSON_5] are waiting for a refund and should get a reply today. [PERSON_4] has waited 10 days for a parcel. Suggested reply to [PERSON_1]: "Dear [PERSON_1], thank you for your patience. Your money is on its way and will be in your account within 5 working days."
| Candidate | Born | ID number | Employer | Experience |
|---|---|---|---|---|
| Louise Brennan | 1985-03-12 | 1234567TA | Shannon Timber Ltd | 12 |
| Michael Doyle | 1992-11-02 | 2345678KB | Liffey Logistics Ltd | 4 |
| Maria Borg | 1988-06-21 | 0123488M | Grand Harbour Metals Ltd | 9 |
| David Fenech | 1979-01-30 | 0456779M | Valletta Pharma Ltd | 18 |
CV Louise Brennan has 12 years' experience in budgeting and monthly reporting at Shannon Timber Ltd. She implemented a new ERP system and leads a team of three. Contact: louise.brennan@example.com.
| Candidate | Born | ID number | Employer | Experience |
|---|---|---|---|---|
| [PERSON_1] | 40–49 years | [ID_1] | [VIRKSOMHED_1] | 12 |
| [PERSON_2] | 30–39 years | [ID_2] | [VIRKSOMHED_2] | 4 |
| [PERSON_3] | 30–39 years | [ID_3] | [VIRKSOMHED_3] | 9 |
| [PERSON_4] | 40–49 years | [ID_4] | [VIRKSOMHED_4] | 18 |
CV [PERSON_1] has 12 years' experience in budgeting and monthly reporting at [VIRKSOMHED_1]. The person implemented a new ERP system and leads a team of three. Contact: [EMAIL_1].
Louise Brennan and Maria Borg have more than 5 years' experience and should be invited to interview; ask Maria Borg about experience with ERP systems. Michael Doyle has 4 years' experience; the requirement is 5. A person makes the decision.
[PERSON_1] and [PERSON_3] have more than 5 years' experience and should be invited to interview; ask [PERSON_3] about experience with ERP systems. [PERSON_2] has 4 years' experience; the requirement is 5. A person makes the decision.
| Supplier | Contact | Account | Expires |
|---|---|---|---|
| Atlantic Components Ltd | Peter Walsh | IE64 IRCE 9205 0112 3456 78 | 2027-01-31 |
| Malta Data Hosting Ltd | Anna Grech | MT84 MALT 0110 0001 2345 MTLC AST0 01S | 2026-12-31 |
| Midlands Precision Ltd | Simon Nolan | IE12 BOFI 9000 0112 3456 78 | 2028-06-30 |
| Celtic Packaging Ltd | Nicole Ryan | IE02 AIBK 9310 6512 9876 54 | 2027-03-31 |
Terms Atlantic Components supplies specialist components for Project Skellig. The price is adjusted annually by the consumer price index plus 3%. Liability is capped at 10% of the annual contract value. Contact Peter Walsh about any changes.
| Supplier | Contact | Account | Expires |
|---|---|---|---|
| [VIRKSOMHED_1] | [PERSON_1] | [IBAN_1] | 2027-01-31 |
| [VIRKSOMHED_2] | [PERSON_2] | [IBAN_2] | 2026-12-31 |
| [VIRKSOMHED_3] | [PERSON_3] | [IBAN_3] | 2028-06-30 |
| [VIRKSOMHED_4] | [PERSON_4] | [IBAN_4] | 2027-03-31 |
Terms [VIRKSOMHED_1] supplies specialist components for [PROJEKT_1]. The price is adjusted annually by the consumer price index plus 3%. Liability is capped at 10% of the annual contract value. Contact [PERSON_1] about any changes.
Atlantic Components Ltd renews automatically unless it is terminated by 31 October. It is important for an internal project, so renegotiate the price rather than terminate. Celtic Packaging Ltd also renews automatically; the deadline is 31 December.
[VIRKSOMHED_1] renews automatically unless it is terminated by 31 October. It is important for an internal project, so renegotiate the price rather than terminate. [VIRKSOMHED_4] also renews automatically; the deadline is 31 December.
What to do
- Find it.It hides in free text: ‘off sick’, ‘pregnant’, ‘halal’, ‘union’.
- Find the basis.Without a basis under Article 9 you may not process it.
- Limit it.Remove it if the task can be done without it.
- Separate it from the name.The AI must never see a name and health data together.
- Do a DPIA.For processing at scale or with new technology.
What the law says
- Article 9 GDPR – special categories of personal data
- A ban with exceptions in Article 9(2).
- Article 10 GDPR – criminal convictions and offences
- Only under official authority or where the law allows it.
- Articles 87 and 88 GDPR – national rules
- EU countries can set their own rules on national ID numbers and on personal data in employment. Check the rules in your country.
- Article 4a AI Act (new)
- Under strict conditions, sensitive data may be used to detect and correct bias in AI.
Questions and answers
Is an allergy sensitive data?
Yes, it is health data.
Is a dietary request such as halal sensitive?
It can reveal religion and should be treated as sensitive.
Does pseudonymisation help?
Yes. When the AI only sees [PERSON_1] and an allergy, the risk to the person is much lower. But for you it is still sensitive personal data.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.