Not all data carries the same risk. A list of public park locations requires minimal protection. A database of client health information requires significant safeguards. Understanding which data is sensitive and applying appropriate protections is a core data management responsibility.
What Makes Data Sensitive
Data is sensitive when its unauthorized disclosure, modification, or loss could cause harm — to individuals, to the organization, or to the public. Common categories of sensitive data include:
- Personal information. Any information about an identifiable individual: name, address, date of birth, financial information, health information, and more.
- Confidential business information. Contracts, financial records, strategic plans, and other information whose disclosure could harm the organization.
- Legally protected information. Information subject to solicitor-client privilege, court orders, or other legal protections.
- Security-sensitive information. Information whose disclosure could enable unauthorized access to systems or facilities.
Core Protection Principles
- Access control. Only people who need access to sensitive data for their work should have it. Review and revoke access when roles change.
- Least privilege. Give people the minimum access necessary to do their job — read-only where write access is not needed, access to specific records rather than entire databases.
- Encryption. Sensitive data should be encrypted at rest and in transit. Most modern cloud platforms do this by default, but verify.
- Secure disposal. When sensitive data is no longer needed, dispose of it securely — not just deleted from a folder, but properly wiped or destroyed.
Privacy by design means building privacy protections into your data systems and processes from the start, rather than adding them as an afterthought. When designing a new form, database, or process that involves personal information, ask: what is the minimum information we need? Who needs access? How will we protect it? How long will we keep it? Answering these questions at the design stage is far more effective than retrofitting protections later.
Recognizing and Responding to Incidents
Even with good protections in place, incidents happen. A data breach, unauthorized access, or accidental disclosure requires a prompt response. Know your organization's incident response process. In Canada, organizations subject to PIPEDA are required to report certain breaches to the Privacy Commissioner and notify affected individuals. Know your obligations before an incident occurs.
Key Takeaways
- Identify which data is sensitive and apply protections proportionate to the risk
- Apply access control and least privilege principles
- Encrypt sensitive data at rest and in transit
- Build privacy protections in from the start, not as an afterthought
- Know your incident response obligations before an incident occurs
Protection also means ensuring data survives accidents and failures. Learn backup strategies in Back Up Important Data.