We process health or religion data, is that simply allowed?

Special categories under GDPR Article 9 are only processable under a specific exception: explicit consent, an employment-law duty, or healthcare provision, for example.

Try this first

1. 1Find where special categories appear: sick-leave, catering allergies, union membership, biometrics for access, diversity-survey responses.
2. 2Pick the right Article 9(2) exception per processing. Sick-leave usually rides on the employment-law exception, with the company doctor as processor.
3. 3Limit who can see it. Sick-leave does not belong with all of HR, only with strictly needed roles.
4. 4Document extras: stronger security, shorter retention where possible, and a DPIA if processing is large-scale or structural.
5. 5Train the people involved in what they may and may not record. The cause of a sick-leave call, for example, often cannot be logged by HR.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.