What is sensitive data?
Definition
Sensitive data is personal information that carries a higher risk of harm or discrimination if it leaks, such as health, religion, sexual orientation, political views or biometric data, and that privacy law protects more strictly.
- Category
- Data
- Also called
- sensitive personal data, special category data
- Last updated
Sensitive data is a subset of personal data. The UK GDPR calls it special category data, and the ICO explains that it needs extra protection because using it carries a greater risk to fundamental rights, such as freedom from discrimination and freedom of religion.
What counts
The UK GDPR lists these categories: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify someone, health data, and data about sex life or sexual orientation. The EU GDPR list is the same.
Data can qualify even if it doesn't state the fact outright. The ICO notes that information that reveals or concerns one of these categories can count, and inferences can too, depending on how an organization uses them. A shopping history that shows you buy medication for a particular condition is one example.
Financial data and criminal offence data are not on the list, though the ICO notes that criminal offence data has its own separate rules, and bank details are still personal data that scammers want.
What the law requires
An organization needs a normal lawful basis to handle your data and, for this group, a second condition from Article 9 of the GDPR. That is why a company can't quietly collect your health information the way it might collect your email address.
Why it matters to you
A leaked email address is annoying. A leaked health record or a list revealing your religion or sexual orientation can cost you a job, a relationship or your safety. Sensitive data is also what blackmail and targeted scams are built on.
Australia's Privacy Act has its own definition of sensitive information; this entry follows the UK and EU GDPR.
How to protect yourself
- 1
Think before you share it
Health, religion and political details shared in forms, apps and social posts can be collected and linked to your name. Share only what you need to.
- 2
Check what apps do with health and biometric data
Read the permissions for fitness, period-tracking and face-unlock features. Turn off sharing with third parties where the app allows it.
- 3
Use your rights
Under UK and EU GDPR you can ask a company what it holds on you and ask it to stop using your data. Put the request in writing to its data protection contact.
- 4
Keep it out of data broker listings
Brokers pull together addresses, relatives and interests that can hint at sensitive facts. Serus finds where your address and phone number are listed on data brokers and people-search sites and removes them for you.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is an example of sensitive data?
Health records, religious beliefs, sexual orientation, political opinions, trade union membership, genetic data and biometric data used for identification.
Is financial information sensitive data under GDPR?
Not in the legal sense. The ICO says financial data isn't special category data, but it is still personal data and needs protecting.
What is the difference between personal data and sensitive data?
Personal data is any information about an identifiable person. Sensitive data is the narrower group on the legal list that gets stricter rules.
Can inferences count as sensitive data?
Yes, the ICO says they can, depending on whether the organization is drawing the inference on purpose or treating people differently because of it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.