What is sensitive data?
Definition
Sensitive data is personal information that carries a higher risk of harm or discrimination if it leaks, such as health, religion, sexual orientation, political views or biometric data, and that privacy law protects more strictly.
Full glossary“The following personal data is considered ‘sensitive’ and is subject to specific processing conditions: data revealing racial or ethnic origin; data revealing political opinions; data revealing religious or philosophical beliefs; data revealing trade union membership; genetic data...”
- Category
- Data
- Also called
- sensitive personal data, special category data
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: ico.org.uk
Last verified against the official page:
Sensitive data is a subset of personal data. The UK GDPR calls it special category data, and the ICO explains that it needs extra protection because using it carries a greater risk to fundamental rights, such as freedom from discrimination and freedom of religion.
What counts
The UK GDPR lists these categories: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify someone, health data, and data about sex life or sexual orientation. The EU GDPR list is the same.
Data can qualify even if it doesn't state the fact outright. The ICO notes that information that reveals or concerns one of these categories can count, and inferences can too, depending on how an organization uses them. A shopping history that shows you buy medication for a particular condition is one example.
Financial data and criminal offence data are not on the list, though the ICO notes that criminal offence data has its own separate rules, and bank details are still personal data that scammers want.
What the law requires
An organization needs a normal lawful basis to handle your data and, for this group, a second condition from Article 9 of the GDPR. That is why a company can't quietly collect your health information the way it might collect your email address.
Why it matters to you
A leaked email address is annoying. A leaked health record or a list revealing your religion or sexual orientation can cost you a job, a relationship or your safety. Sensitive data is also what blackmail and targeted scams are built on.
Australia's Privacy Act has its own definition of sensitive information; this entry follows the UK and EU GDPR.
How to protect yourself
- 1
Think before you share it
Health, religion and political details shared in forms, apps and social posts can be collected and linked to your name. Share only what you need to.
- 2
Check what apps do with health and biometric data
Read the permissions for fitness, period-tracking and face-unlock features. Turn off sharing with third parties where the app allows it.
- 3
Use your rights
Under UK and EU GDPR you can ask a company what it holds on you and ask it to stop using your data. Put the request in writing to its data protection contact.
- 4
Keep it out of data broker listings
Brokers pull together addresses, relatives and interests that can hint at sensitive facts. Serus finds where your address and phone number are listed on data brokers and people-search sites and removes them for you.
See it in action
- Scam Apple Store email scams: how to spot a fake receipt or account alert
- Scam Whaling phishing: how scammers target executives and what it looks like
- Data broker Datonics
- Data breach Alaska Airlines data breach: what happened and what to do
- Data breach Angel One data breach: what happened and what to do
- Data broker Aged Lead Store
The law
- Australia Australia's Privacy Act: access, correct and opt out of direct marketing
- Australia (Commonwealth) Australian Privacy Act access request template (APP 12)
- California California Delete Act: how to use DROP to delete your data from data brokers
- California, United States CCPA Do Not Sell or Share request template for California
- California, United States CCPA request to delete template: a letter for California residents
- California CCPA: how to delete, see and stop the sale of your data in California
- Colorado Colorado Privacy Act (CPA): your rights, Global Privacy Control and how to complain
- Connecticut Connecticut Data Privacy Act (CTDPA): deleting people-search profiles and your other rights
- Delaware Delaware Personal Data Privacy Act (DPDPA): your rights and how to use them
- Indiana Indiana Consumer Data Protection Act: your rights since January 1, 2026
- Iowa Iowa Consumer Data Protection Act (ICDPA): your rights and the 90-day clock
- Kentucky Kentucky Consumer Data Protection Act (KCDPA): your rights and how to use them
- Maryland Maryland Online Data Privacy Act (MODPA): your rights and how to use them
- Minnesota Minnesota Consumer Data Privacy Act (MCDPA): your rights and how to use them
- Montana Montana Consumer Data Privacy Act (MCDPA): rights, opt-out signals and the 2025 changes
- Nebraska Nebraska Data Privacy Act (NDPA): your rights and how to use them
- New Jersey New Jersey Data Privacy Act (NJDPA): your rights, deadlines and the coming data broker registry
- Oregon Oregon Consumer Privacy Act (OCPA): your rights and how to use them
- Rhode Island Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA): your rights and how to use them
- Tennessee Tennessee Information Protection Act (TIPA): your rights since July 2025
- Texas Texas Data Privacy and Security Act (TDPSA): your rights and how to use them
- Utah Utah Consumer Privacy Act (UCPA): what you can and can't make companies do
- Vermont Vermont privacy law: the data broker registry now, deletion rights from 2028
- Virginia Virginia Consumer Data Protection Act (VCDPA): your rights and how to use them
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is an example of sensitive data?
Health records, religious beliefs, sexual orientation, political opinions, trade union membership, genetic data and biometric data used for identification.
Is financial information sensitive data under GDPR?
Not in the legal sense. The ICO says financial data isn't special category data, but it is still personal data and needs protecting.
What is the difference between personal data and sensitive data?
Personal data is any information about an identifiable person. Sensitive data is the narrower group on the legal list that gets stricter rules.
Can inferences count as sensitive data?
Yes, the ICO says they can, depending on whether the organization is drawing the inference on purpose or treating people differently because of it.
Sources
- What is special category data? · ico.org.uk
Something wrong or out of date? Tell us and we'll re-check it.
