Sensitive Information
What is Sensitive Information?
Information that, if disclosed improperly, could cause harm to individuals or the organization, requiring enhanced protection measures.
Terms that appear alongside sensitive information
Each of these is named in at least one of the same controls as sensitive information. The number is how many controls name both.
- consent 6 shared controls
- data subject 4 shared controls
- governance 4 shared controls
- authentication 4 shared controls
- confidentiality 4 shared controls
- data subject rights 3 shared controls
- integrity 3 shared controls
- owasp 3 shared controls
Frameworks that govern sensitive information
What the standards actually require on sensitive information
Requirements naming sensitive information across 6 standards, quoted from the control text.
Section 2 of the Privacy Protection Law defines 'information' broadly as data on personality, personal status, intimate affairs, health, economic status, professional qualifications, opinions and beliefs.
PPL-S2-DEF · Personal Information and Sensitive Information Definitions →Korea PIPA Articles 23-25 special categories + unique identifiers. Article 23 sensitive information (ideology + belief + trade union + political affiliation + health + sexual orientation + biometric + genetic + criminal record) requires separate explicit conse...
PIPA-Sensitive-Information-Unique-ID-Resident-Registration-Numbers-CCTV-Articles-23-24-25 · Korea PIPA Sensitive Information + Unique ID + RRN + CCTV + Articles 23-25 →Identify the information and servers that are most sensitive to the entity and maintain an up to date diagram of the network showing them.
ANSSI-HYG-04 · Identify the Most Sensitive Information and Servers and Maintain a Network Diagram →Per Privacy Act + OAIC guidance: heightened safeguards. Requirements include (a) implement Sensitive Information Handling per definition in Privacy Act including health + genetic + biometric + ethnicity + religion + political + sexual orientation + criminal re...
AUPRV-6 · Sensitive Information, PIA, Privacy by Design, Children →Apply heightened safeguards when processing sensitive information including health, genetic, biometric, racial, political, religious, trade union, sexual life and criminal data, including explicit consent or another specific statutory ground and a documented n...
ZDPA-04 · Sensitive Information Processing Safeguards →Rank 17 in the 2024 CWE Top 25 (frequency x severity of CVEs). The product exposes sensitive information to an actor that is not explicitly authorised to have access to it.
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor →Questions people ask about sensitive information
What is Sensitive Information?
Why is Sensitive Information important for compliance?
Which compliance frameworks address Sensitive Information?
Where can I learn more about Sensitive Information?
See how Sensitive Information applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.