What counts as sensitive personal data under the GDPR?

Sensitive personal data are special categories of personal data under Article 9 GDPR, such as health data, biometric and genetic data for unique identification, political opinions, religious beliefs, trade union membership and data about sex life or sexual orientation.

When may sensitive personal data be processed?

Processing is allowed only if an exception in Article 9(2) GDPR applies, such as explicit consent, specific healthcare purposes or where required under employment and social protection law, and the processing must be documented and safeguarded.

How should organisations protect sensitive personal data in practice?

Use a risk-based approach with technical and organisational measures such as encryption, role-based access, logging, staff training, clear procedures for breach reporting, and data protection impact assessments where required.

Sensitive personal data

Sensitive personal data are special categories of personal data that require stronger protection under the GDPR.

Glossary
Sensitive personal data

Explained – what does sensitive personal data mean?

Sensitive personal data, also referred to as special categories of personal data, include information revealing a person’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, sex life or sexual orientation, as well as biometric data and genetic data. Such processing is subject to heightened protection under Article 9 GDPR.

A Data Protection Officer (DPO) plays a central role in ensuring that an organisation handles sensitive personal data lawfully and securely. The DPO monitors compliance with data protection rules, trains staff and acts as the contact point vis-à-vis the Data Protection Agency. Many organisations engage an outsourced data protection officer to fulfil this function efficiently across Europe.

These categories of data often arise in healthcare, HR administration, research and membership organisations. They also arise commonly in employment relationships, which means many companies process such data to some extent.

When is the issue of sensitive personal data relevant?

The issue arises whenever processing relates to the most private aspects of an individual’s life. This is particularly the case in recruitment, medical treatment, customer surveys or digital services that collect special categories of personal data.

An employer recording sickness absence, a research project processing genetic data, or an app using facial recognition must always ensure a valid legal basis and, where required, obtain explicit consent under Article 9(2) GDPR. This is core to the processing of sensitive personal data.

Businesswoman standing confidently in front of digital data and padlock icon, symbolising GDPR protection of sensitive personal data and information security.

Key considerations for sensitive personal data

When organisations process sensitive personal data, specific safeguards and clear procedures are required. The following points highlight the essentials of a compliant approach.

Identify whether the data fall within the special categories under Article 9 GDPR.
Ensure a valid legal basis applies, for example explicit consent or a legal obligation under labour law.
Implement technical and organisational measures such as encryption, role-based access and access logging.
Train staff on handling sensitive data to minimise unauthorised access and to respect purpose limitation.
Establish procedures for personal data breach reporting to the Data Protection Agency.
Document processing in the organisation’s register of processing activities.
Involve the Data Protection Officer—an internal or outsourced data protection officer—when designing procedures and in data protection impact assessments under Article 35 GDPR.

The processing of sensitive personal data is regarded as so worthy of protection that it has a dedicated article in the GDPR. It therefore requires particular attention to ensure compliance with the Regulation.

Sensitive personal data

Why are sensitive personal data important?

Sensitive personal data concern the most private sphere of individuals. Improper processing can lead to serious privacy infringements and harm both individuals and organisations. High levels of transparency in, for example, privacy notices and robust security are therefore essential.

Proper handling demonstrates respect for data subjects’ rights under the GDPR and builds long-term trust with customers, patients and employees across Europe.

Prioritising protection fosters a culture of accountability and respect for personal privacy, strengthening the relationship between organisation and individual.

Sensitive personal data include health data, political opinions, religion, sexual orientation, trade union membership personal data, and biometric and genetic identifiers used for unique identification (biometric data GDPR, genetic data GDPR).

Processing is permitted only if an exception in Article 9(2) GDPR applies—for example explicit consent, healthcare purposes, or where required under employment law. Always align with Article 9 GDPR and document the processing of sensitive personal data.

Improper handling can cause serious privacy violations, compensation claims and administrative fines. To reduce risks, organisations should:

Train staff in data protection.
Use technical controls such as encryption, access controls and logging.
Involve the DPO in risk assessments and ensure timely personal data breach reporting.

Adopt a risk-based approach: implement multi-factor authentication (2FA) and logging, define internal procedures for access management and erasure, and conduct regular checks and internal audits. Maintain an up-to-date register of processing activities and carry out data protection impact assessments where required.

The DPO monitors compliance, advises on impact assessments and acts as the contact point to the Data Protection Agency. Where appropriate, appointing an outsourced data protection officer is an effective way to secure experienced oversight and clear DPO responsibilities.

Personal data are any information relating to an identifiable person (for example name, email address or IP address). Sensitive personal data concern more protected aspects of an individual’s life and are therefore subject to stricter rules under the GDPR. Some “ordinary” personal data may still be particularly sensitive depending on context and require enhanced protection.

Sensitive personal data (special categories of personal data) require robust safeguards, a valid legal basis and, where needed, explicit consent. Embed security by design, keep your register of processing activities accurate, perform DPIAs, and ensure clear lines for personal data breach reporting—supported by a capable DPO function.