Sensitive or special category data includes racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health or data concerning a person’s sex life or sexual orientation. Processing of sensitive or personal category data shall be prohibited unless in the following specific circumstances:

• the data subject has given explicit consent
• processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection
• processing is necessary to protect the vital interests of the data subject or of another person where the data subject is physically or legally incapable of giving consent
  
  

Iprotectu has GDPR awareness training for managers on what you can and cannot process and what the legal data processing requirements are