What are some examples of sensitive data according to the GDPR?

Understanding Sensitive Data Under the GDPR

When it comes to data protection, the General Data Protection Regulation (GDPR) draws a clear line between regular personal information and what it considers "special categories" of data—commonly referred to as sensitive data. These categories require a higher level of protection due to the significant risks their misuse could pose to an individual’s fundamental rights and freedoms.

Among the most notable types of sensitive data are genetic data, which includes personal information derived from biological samples and used to provide unique insights into a person’s inherited characteristics. Equally protected is biometric data—but only when it’s processed specifically to identify someone. This includes fingerprints, facial recognition patterns, or iris scans used in security systems.

Another critical category is health-related data. This covers anything from medical records and diagnoses to treatment plans, disability status, or even data collected through wearable health devices. Because of its deeply personal nature, such information is strictly safeguarded under the GDPR.

Finally, the regulation explicitly protects data concerning an individual’s sex life or sexual orientation. This ensures privacy in areas where exposure could lead to discrimination, stigma, or social harm. Whether it’s stored in health records, dating apps, or personal correspondence, this type of information demands the highest level of confidentiality.

Organizations handling any of these data types must implement robust technical and organizational measures, obtain explicit consent where required, and ensure processing is lawful and justified. The GDPR’s strict approach reflects a broader commitment to preserving dignity, autonomy, and trust in a digital world where personal boundaries matter more than ever.