Sensitive Personal Data
What is Sensitive Personal Data?
Categories of personal data that require enhanced protection due to their sensitive nature. Under GDPR, this includes racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, and data concerning sex life or sexual orientation.
Terms that appear alongside sensitive personal data
Each of these is named in at least one of the same controls as sensitive personal data. The number is how many controls name both.
- consent 58 shared controls
- data subject 35 shared controls
- gdpr 30 shared controls
- biometric data 24 shared controls
- data protection 22 shared controls
- compliance 15 shared controls
- health data 15 shared controls
- lawful basis 13 shared controls
Frameworks that govern sensitive personal data
What the standards actually require on sensitive personal data
Requirements naming sensitive personal data across 6 standards, quoted from the control text.
Controllers that sell sensitive personal data must post the exact notice: 'NOTICE: We may sell your sensitive personal data.' Controllers that sell biometric personal data must post: 'NOTICE: We may sell your biometric personal data.' Notices must be in the sa...
TDPSA-541-052 · Sale of Sensitive Personal Data Notice →In addition to the Article 9 obligations, the DPO of the controller or processor must follow and implement the security policies and procedures necessary to avoid any breach or infringement of sensitive personal data.
EGY-PDPL-Art.13 · DPO security duties for sensitive personal data →Article 9 of the Kazakhstan PDPL establishes enhanced protections for Sensitive Personal Data (Sensitivnye personaľnye dannye). (1) Article 9 Sensitive Personal Data Categories: (a) Race or ethnic origin; (b) Political opinion or party membership;
KZ-PDPL-Sensitive-Personal-Data-Article9-Special-Categories-Race-Religious-Political-Health-Genetic-Biometric · Kazakhstan PDPL Sensitive Personal Data + Article 9 + Special Categories + Race + Ethnic Origin + Religious + Political + Trade Union + Sexual Life + Criminal + Health + Genetic + Biometric + Enhanced Written Consent + Special Safeguards →Processing of sensitive personal data and personality profiles requires explicit consent or another statutory basis, with stricter safeguards including limitations on disclosure to third parties.
CH-FADP-03 · Sensitive personal data and personality profiles →Prohibition on sensitive data. Section 20 prohibits the processing of sensitive personal data except where a permitted exception applies.
BW-DPA-s20 · Prohibition for processing of sensitive personal data →Article 6 (SENSITIVE PERSONAL DATA) - processing of sensitive personal data is PROHIBITED unless one of specific conditions applies: (a) EXPLICIT consent (heightened beyond ordinary consent);
UAE-PDPL-Art.6_7 · Sensitive personal data and children's data (UAE PDPL Articles 6-7) →Questions people ask about sensitive personal data
What is Sensitive Personal Data?
Why is Sensitive Personal Data important for compliance?
Which compliance frameworks address Sensitive Personal Data?
Where can I learn more about Sensitive Personal Data?
See how Sensitive Personal Data applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.