Sensitive Personal Data
What is Sensitive Personal Data?
Categories of personal data that require enhanced protection due to their sensitive nature. Under GDPR, this includes racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, and data concerning sex life or sexual orientation.
Terms that appear alongside sensitive personal data
Each of these is named in at least one of the same controls as sensitive personal data. The number is how many controls name both.
- consent 58 shared controls
- data subject 35 shared controls
- gdpr 30 shared controls
- biometric data 24 shared controls
- data protection 22 shared controls
- compliance 15 shared controls
- health data 15 shared controls
- lawful basis 13 shared controls
Frameworks that govern sensitive personal data
What the standards actually require on sensitive personal data
Requirements naming sensitive personal data across 6 standards, quoted from the control text.
A data controller may process sensitive personal data (health, political opinions, religious or similar beliefs, offences, and biometric data) only with the data subject's explicit consent, where necessary for an employment-law right or obligation, to protect...
malaysia-pdpa-2010::40 · Section 40: sensitive personal data (including biometric data since 1 April 2025) only with explicit consent or a listed necessity →Article 9 of the Kazakhstan PDPL establishes enhanced protections for Sensitive Personal Data (Sensitivnye personaľnye dannye). (1) Article 9 Sensitive Personal Data Categories: (a) Race or ethnic origin; (b) Political opinion or party membership;
KZ-PDPL-Sensitive-Personal-Data-Article9-Special-Categories-Race-Religious-Political-Health-Genetic-Biometric · Kazakhstan PDPL Sensitive Personal Data + Article 9 + Special Categories + Race + Ethnic Origin + Religious + Political + Trade Union + Sexual Life + Criminal + Health + Genetic + Biometric + Enhanced Written Consent + Special Safeguards →When processing sensitive personal data the controller or processor must comply with the Law's protection and monitoring requirements; comply with the applicable retention periods; put in place measures to strengthen the capacity of staff involved;
rwanda-dpl::11 · Safeguards when processing sensitive personal data →Processing of sensitive personal data and personality profiles requires explicit consent or another statutory basis, with stricter safeguards including limitations on disclosure to third parties.
CH-FADP-03 · Sensitive personal data and personality profiles →Prohibition on sensitive data. Section 20 prohibits the processing of sensitive personal data except where a permitted exception applies.
BW-DPA-s20 · Prohibition for processing of sensitive personal data →In addition to the Article 9 duties, the DPO of a controller or processor follows and implements the security policies and procedures necessary to prevent any breach or infringement of sensitive personal data.
egypt-personal-data-protection-law-law-no-151-of-2020::Art.13 · Art.13 DPO security duties for sensitive personal data →Questions people ask about sensitive personal data
What is Sensitive Personal Data?
Why is Sensitive Personal Data important for compliance?
Which compliance frameworks address Sensitive Personal Data?
Where can I learn more about Sensitive Personal Data?
See how Sensitive Personal Data applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.