Categories of personal data that carry greater privacy risk and therefore warrant stronger protection — such as health, financial, racial or ethnic origin, religious beliefs, sexual orientation, or biometric information.
Not all personal information carries the same risk. Sensitive data categories are those where unauthorized disclosure could cause serious harm — discrimination, financial loss, physical danger, or significant distress. Privacy laws in many jurisdictions impose stricter requirements for collecting and handling sensitive data.
Under GDPR, special categories of sensitive data include racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, and data concerning sex life or sexual orientation. Canadian privacy law does not use the same explicit list but recognizes that some personal information is more sensitive than others.
Example: A dataset of employee records contains names, job titles, and salaries. Adding health condition information makes it sensitive data — the health information requires stronger access controls, stricter retention limits, and more careful handling than the other fields.
This is educational information, not legal advice. Consult a qualified privacy professional for guidance on specific situations.