General

sensitive information

Special-category personal data requiring heightened protection.

How the laws define this

Both regulatory sources agree that sensitive information includes personal data or personal information subject to strict processing conditions, safeguards, and handling limitations. The fundamental point of divergence lies in the overall scope of content each instrument regulates. Under the Personal Information Protection Act, sensitive information (designated as 민감정보) is focused strictly on personal attributes, specifically data concerning race, health, sexual life, and other sensitive attributes governed by PIPA safeguards. Conversely, the Guidance to civil servants on use of generative AI adopts a broader definition that extends beyond personal data to encompass classified material and non-public policy intent. Additionally, this guidance mandates that sensitive information must not be entered into public generative AI services and requires adherence to UK GDPR/Data Protection Act and DPIA requirements.

Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.

Definitions (2)

Personal information designated as 민감정보 (sensitive information), such as data concerning race, health, sexual life, and other sensitive attributes, which PIPA treats with stricter processing conditions, safeguards, and limitations.

Sensitive information encompasses classified material, non-public policy intent, and personal data; the guidance requires that such information not be entered into public generative AI services and that handling follow UK GDPR/Data Protection Act and DPIA requirements.