Sensitive data

Sensitive data is the everyday term for what the GDPR calls special categories of personal data: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a natural person's sex life or sexual orientation (Art. 9(1)). Data relating to criminal convictions and offences is governed separately by Art. 10, and some national laws and the Swiss FADP add further categories such as social security measures.

The processing of sensitive data is prohibited unless one of the ten exceptions of Art. 9(2) applies, including explicit consent, employment and social security law, vital interests, processing by non-profit bodies, data manifestly made public, legal claims, substantial public interest, health and social care, public health, and scientific research with Art. 89 safeguards. Member States may add conditions for genetic, biometric and health data (Art. 9(4)). Sensitive data also triggers other obligations: a mandatory DPIA for large-scale processing (Art. 35(3)(b)), the appointment of a DPO where such processing is a core activity (Art. 37(1)(c)), loss of the small-organisation exemption from record-keeping (Art. 30(5)), and the highest fine tier.

The term "sensitive" is also used loosely to describe data that is commercially confidential (trade secrets, unpublished trial results) or that carries elevated risk without falling under Art. 9 (financial data, location data, children's data). These deserve strong protection but are not special category data in the legal sense, and conflating them leads to both over- and under-compliance. For life sciences companies, virtually all patient-facing processing involves health data and therefore sits at the most demanding end of the GDPR.