What is sensitive data in GDPR?

Sensitive data generally means the special categories of personal data protected under Article 9 of the GDPR. These include:

• Racial or ethnic origin.

• Political opinions, religious or philosophical beliefs, and trade union membership.

• Genetic data.

• Biometric data used to uniquely identify someone.

• Health data, sex life or sexual orientation.

According to the European Commission’s guidance on sensitive data, processing is generally prohibited unless an Article 9 condition applies. Organisations also need an Article 6 lawful basis.

Explicit consent is one possible condition; others include qualifying healthcare, employment and substantial public-interest grounds, subject to their legal requirements.

Criminal conviction and offence data has separate safeguards under Article 10. Financial details and passwords require protection but are not automatically Article 9 special-category data.