Information needing extra care.
WHAT IS TYPICALLY TREATED AS SENSITIVE
Health information Racial or ethnic origin Religious or philosophical beliefs Political opinions Trade union membership Genetic and biometric data Sex life and sexual orientation
WHY THEY ARE SEPARATE
Misuse causes disproportionate harm, including discrimination.
WHAT PROCESSING THEM USUALLY REQUIRES
A lawful basis, plus an additional condition.
WHAT ADDITIONAL CONDITIONS TYPICALLY INCLUDE
Explicit consent Employment or social protection obligations Vital interests Legal claims Substantial public interest, as defined
WHAT TO DO FIRST
Ask whether you need it at all.
WHY
Most organisations collect sensitive data without a genuine need.
WHAT EXAMPLES LOOK LIKE
Health questions on forms with no purpose Religion collected for no stated reason
WHAT TO DO ABOUT THOSE
Stop collecting them.
WHAT EXTRA MEASURES TO APPLY WHERE YOU DO
Restricted access Encryption Shorter retention Additional logging
WHAT TO BE CAREFUL WITH
Data revealing sensitive categories indirectly.
WHAT EXAMPLES LOOK LIKE
Dietary requirements implying religion Photographs implying ethnicity Purchase history implying health
WHAT TO DOCUMENT
The condition relied upon, per activity.
WHAT TO TAKE ADVICE ON
Anything involving health or biometric data at scale.
