Skip to main content
Praxikon

Legislation in motion

Proposal: exception for incidental special category data in AI development (Article 9(2)(k) and 9(5) GDPR)

Date
Status
proposal
Body
Europese Commissie
Reference
COM(2025) 837 final, artikel 3, punt 3 (wijziging artikel 9 AVG); 2025/0360(COD); ST 15698/25

What it is about

A new exception to the ban on processing special categories of personal data would cover the development and operation of an AI system or model, provided appropriate technical and organisational measures are taken to avoid collecting or otherwise processing such data. Where such data are nevertheless identified in training, testing or validation datasets or in the AI system or model, the controller must remove them; if removal requires disproportionate effort, the controller must in any event effectively protect them without undue delay from being used to produce outputs and from disclosure to third parties. Recital 33 states the derogation does not apply where special category data are necessary for the processing; Article 9(2)(a) to (j) then applies. The EDPB and EDPS recommend adding the words incidental and residual to the enacting terms (Joint Opinion 2/2026, para 48).

What this means in practice

If adopted, you would no longer need to fit incidental special category data in AI training into one of the existing Article 9 exceptions. You would need demonstrable filtering measures, a removal process, and documentation of when removal is disproportionate and what protection you apply instead. As of 15 September 2026 this is still a proposal: the Council has no general approach and Parliament no position, so do not rely on it yet.

The GDPR articles concerned

Source: Raad van de EU, register (COM(2025) 837 final als ST 15698/25); EDPB-EDPS Joint Opinion 2/2026checked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

Case law

Guidelines

Legislation in motion6 of 17