Why is health data classified as specific personal data under UU 27/2022?
Article 4 paragraph (2)(a) of UU 27/2022 classifies individual physical, mental, and healthcare service records as specific personal data because misuse carries higher discrimination and harm risks.
Put the evidence in context
Review the intended task, source information, human checkpoints and observed results together. A benchmark or sandbox result has a defined scope; it does not establish suitability, approval or performance for every institution.
Read the full explanationCare Workspace connects healthcare work such as appointments, reviewed reporting and follow-up. Micromeet Cowork supports team work with digital employees and reusable Skills, including meeting summaries, decisions and task handoffs.
Read the full explanationYes. Article 4 paragraph (2)(a) of Law Number 27 of 2022 on Personal Data Protection (UU 27/2022) classifies health data and information as specific personal data. The elucidation of that article defines health data and information as individual records or details relating to physical health, mental health, and/or healthcare services. Consequently, its scope is much broader than a clinical diagnosis alone. The elucidation of Article 4 paragraph (1)(a) explains the rationale. Processing specific data carries a higher potential impact on the data subject, including discrimination and greater harm.
Health data is not the only category in this tier. Article 4 paragraph (2) also lists biometric data, genetic data, criminal records, child data, and personal financial data. Meanwhile, Article 4 paragraph (3) classifies full name, gender, nationality, religion, marital status, and combined identifying data as general personal data. A medical check-up file containing both a patient's identity and laboratory findings therefore combines general and specific personal data, and a pediatric patient file qualifies as specific data on both health and child grounds.
Because health data is specific personal data, controllers face heightened statutory obligations. Article 34 paragraph (1) and paragraph (2)(b) require a Data Protection Impact Assessment (DPIA) for high-risk processing of specific data. At the same time, Article 53 paragraph (1)(c) requires appointing a Data Protection Officer (DPO) when core activities involve large-scale processing of specific data. Violating DPIA (Article 34), security (Article 35), confidentiality (Article 36), or DPO appointment (Article 53) rules triggers administrative sanctions under Article 57 paragraphs (1)–(3), including fines of up to two percent of annual revenue against the violation variable.
Law Number 17 of 2023 on Health reinforces these protections. Article 4 paragraph (1)(i) grants every person the right to confidentiality of personal health data and information, subject only to narrow statutory exceptions in paragraph (4). Furthermore, Article 351 paragraph (2) protects individual health data. Processing within health information systems must obtain the data owner's consent and/or satisfy another valid legal basis under personal data protection law.
Legal basis
- Law Number 27 of 2022 on Personal Data Protection (UU 27/2022): Article 4 paragraphs (1), (2), and (3) and their Elucidation; Article 34 paragraph (1); Article 35; Article 36; Article 53 paragraph (1)(c) and paragraph (3); and Article 57 paragraphs (1), (2), and (3).
- Law Number 17 of 2023 on Health: Article 4 paragraph (1)(i) and paragraph (4); and Article 351 paragraph (2).