Rights & Ethics

Sensitive Data

Data requiring stricter protection due to privacy risks.

How the laws define this

Regulators and official guidelines consistently treat sensitive data as personal information requiring heightened safeguards, stricter legal bases, or express consent because misuse creates privacy, legal, or ethical risks. Core categories repeatedly include health information, racial or ethnic origin, political opinions, religious beliefs, biometric identifiers, and sexual life. However, these sources diverge on scope. Statutory instruments like Ley No. 81 de 26 de marzo de 2019 del Protección de Datos Personales restrict the concept to personal data, whereas the Ethics Guide for Generative Artificial Intelligence Use in Scientific Research and Publication in Higher Education Institutions expands it to confidential datasets and proprietary information. Additionally, the Artificial Intelligence Disclosure and Safety Act uniquely includes data revealing or inferring mental or emotional states, psychological profiling, or emotional analysis, while the Guide on the Use of Social Media and the Internet for Media Practice in Kenya (Media Council of Kenya draft) extends protection to minors and vulnerable sources.

Synthesised from the 10 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
Hawaii, United States	Artificial Intelligence Disclosure and Safety Act	In Force	Adds mental or emotional state, biometric identifiers, and information for psychological profiling or emotional analysis, tying to AI companions.
Ecuador	Organic Law on the Protection of Personal Data (LOPDP)	In Force	Includes biometric data for identification alongside standard categories like health, racial origin, political opinions, and religious beliefs.
Senegal	Law No. 2008-12 on the Protection of Personal Data	In Force	Imposes stricter regimes like registration, declaration, or prior authorization by the supervisory authority for listed categories.
Panama	Executive Decree No. 285 of May 28, 2021, Regulating Law 81 of March 26, 2019, on Personal Data Protection	In Force	Adds sexual orientation to standard categories and explicitly requires higher protection levels and express consent.
Chile	Law No. 21.719 — Regulates the protection and processing of personal data and creates the Personal Data Protection Agency	Awaiting Entry	Enumerates biometric or genetic data and sexual life, restricting processing to stronger legal bases and protective measures.
Turkey	Ethics Guide for Generative Artificial Intelligence Use in Scientific Research and Publication in Higher Education Institutions	In Force	Broadens to personally identifiable information, confidential datasets, or proprietary information posing privacy, legal, or ethical risks in GAI use.
Slovakia	AI in Education — Guidance for Educators	In Force	Applies to education AI services, warning to avoid sharing with third-party providers unless necessary and GDPR-compliant.
Colombia	Medellín Police Facial Recognition System	In Force	Links to facial recognition policy, demanding prior express informed consent under Law 1581 unless public function exceptions apply.
Kenya	Guide on the Use of Social Media and the Internet for Media Practice in Kenya (Media Council of Kenya draft)	Draft	Focuses on media practice, covering minors, vulnerable sources, intimate details with stricter handling, minimisation, and consent.
Panama	Law No. 81 of March 26, 2019 on Personal Data Protection	In Force	Limits to racial or ethnic origin, political opinions, religious beliefs, or health information, plainly requiring explicit consent.

What it triggers

In Hawaii, under the Artificial Intelligence Disclosure and Safety Act, collection and use of such data are subject to specific regulations.source
In Panama, under Executive Decree No. 285, such data requires higher levels of protection and express consent.
In Panama, under Law No. 81, processing of such data requires explicit consent.
In Senegal, under Law No. 2008-12, processing imposes stricter regimes such as registration, declaration or prior authorization by the supervisory authority.

Definitions (10)

A class of personal data that affects privacy or can cause discrimination if misused, including biometric data, health, racial or ethnic origin, political opinions, and sexual life. Under Law 1581 of 2012, sensitive data demands stricter safeguards and normally prior, express, informed consent unless specific legal exceptions apply for public functions.

Medellín Police Facial Recognition SystemDefinition 1 of 10

Personal data revealing health information, biometric data for identification, racial or ethnic origin, political opinions, religious or philosophical beliefs, and other specially protected categories which require heightened legal safeguards and typically stricter lawful-basis conditions for processing.

Organic Law on the Protection of Personal Data (LOPDP)Definition 2 of 10

Specific categories of personal data that warrant special protection—explicitly including racial or ethnic origin, political opinions, religious beliefs, health data, genetic data and similar categories—and for which the law imposes stricter regimes such as registration, declaration or prior authorization by the supervisory authority.

Law No. 2008-12 on the Protection of Personal DataDefinition 3 of 10

Personally identifiable information, confidential datasets, or proprietary information that pose privacy, legal, or ethical risks if disclosed or processed by third parties. The Guide warns against uploading sensitive data to external GAI platforms without appropriate contracts, data protection assessments, and technical safeguards.

Ethics Guide for Generative Artificial Intelligence Use in Scientific Research and Publication in Higher Education InstitutionsDefinition 4 of 10

Personal data that reveal or concern race or ethnicity, political opinions, religious or philosophical beliefs, health, sexual life, biometric or genetic data, and other categories enumerated by the law; processing of such data is restricted and requires stronger legal bases and protective measures.

Law No. 21.719 — Regulates the protection and processing of personal data and creates the Personal Data Protection AgencyDefinition 5 of 10

Personal data that, due to its nature, requires enhanced safeguards (for example data concerning minors, vulnerable sources, intimate details or other identifiers that could cause harm if disclosed). The Guide applies stricter handling, minimisation and consent requirements to sensitive data in line with the Data Protection Act.

Guide on the Use of Social Media and the Internet for Media Practice in Kenya (Media Council of Kenya draft)Definition 6 of 10

Personal data categories that merit higher protection (for example health information, racial or ethnic origin, political opinions, religious beliefs, sexual life or orientation) which the guidance warns should be avoided when using third-party AI services unless strictly necessary and compliant with GDPR and national law. Schools are advised to perform data-protection checks and minimize sharing of such data with AI providers.

AI in Education — Guidance for Educators (Usmernenie o AI pre pedagógov)Definition 7 of 10

Information that reveals racial origin, political opinions, religious beliefs, health, or sexual orientation, requiring higher levels of protection and express consent.

Decreto Ejecutivo N° 285 de 28 de mayo de 2021 que reglamenta la Ley 81 de 26 de marzo de 2019, sobre Protección de Datos PersonalesDefinition 8 of 10

Personal data that reveals racial or ethnic origin, political opinions, religious beliefs, or health information, requiring explicit consent for processing.

Ley No. 81 de 26 de marzo de 2019 del Protección de Datos PersonalesDefinition 9 of 10

Defined as personal data that reveals or infers a mental or emotional state, health information, biometric identifiers, or other information used for psychological profiling or emotional analysis. The collection and use of such data are subject to specific regulations.

Artificial Intelligence Disclosure and Safety ActDefinition 10 of 10

Not to be confused with

Sensitive personal information

Sensitive personal information specifies highly sensitive data needing explicit consent, while sensitive data covers broader categories with varying protections.

special categories of data

Special categories of data emphasize higher safeguards for sensitive personal data, similar but without the explicit consent focus of sensitive personal information.

Questions and answers

What extra protections apply to sensitive data in Panama?

Both Law No. 81 and Executive Decree No. 285 require explicit or express consent for processing data revealing racial origin, political opinions, religious beliefs, health, or sexual orientation. These impose higher protection levels.

Does sensitive data include biometric or genetic information?

Yes, in Chile's Law No. 21.719 and Ecuador's LOPDP, it includes biometric or genetic data alongside health and other categories.

What duties arise for sensitive data in AI or specific sectors?

Hawaii's Act subjects it to specific regulations for AI companions; Senegal's law requires supervisory authority regimes; guidelines in Turkey, Slovakia, and Colombia recommend or warn against sharing without safeguards.