Sensitive personal data
Personal data warranting enhanced protections.
How the laws define this
Regulators consistently treat sensitive personal data as high-risk categories of personal information—such as health, biometric, genetic, political, or religious data—that require heightened safeguards, enhanced protections, and stricter lawful processing conditions than standard data. Their primary divergence lies in which additional scope of categories triggers these heightened protections and the precise compliance mechanisms required. Financial data is explicitly protected under the Personal Data Protection Law (PDPL) (Royal Decree M/19) and the Personal Data Protection Bill, 2023, whereas trade-union membership is included in Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data. Furthermore, data concerning minors and unique identifiers are specifically brought under this standard by the Guide on Processing Publicly Available Personal Data for AI Development and Services (AI 개발·서비스를 위한 공개된 개인정보 처리 안내서) - Personal Information Protection Commission. Compliance duties also vary, as Law No. 09-08 requires prior authorization, while the Nigeria Data Protection Act (NDPA) triggers data protection impact assessments.
Synthesised from the 16 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first. Showing 10 of the 16 instruments that define this term; all are listed under Definitions below.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| Ethiopia | Personal Data Protection Proclamation No. 1321/2024 | In Force | Explicitly includes sexual orientation and other categories designated as sensitive, subject to stricter processing requirements under the Proclamation. |
| Nigeria | Nigeria Data Protection Act (NDPA) | In Force | Treats it as data of a special nature triggering higher protection requirements, DPIAs where applicable, and stricter conditions for cross-border transfer. |
| Rwanda | Law No. 058/2021 Relating to the Protection of Personal Data and Privacy | In Force | Explicitly lists sexual orientation alongside standard categories, subject to enhanced safeguards and stricter processing conditions. |
| Saudi Arabia | Personal Data Protection Law (PDPL) (Royal Decree M/19) | In Force (Amended) | Includes financial and criminal data alongside health, biometric and genetic data, with additional technical, organizational, and procedural controls. |
| Taiwan | Personal Data Protection Act (PDPA) | In Force (Amended) | Explicitly limits it to medical records, genetic data, sexual health information, physical examination results, and criminal records, generally prohibiting processing unless statutory conditions met. |
| Thailand | Personal Data Protection Act B.E. 2562 (2019) | In Force | Includes religion and criminal records explicitly, subject to stricter conditions under the PDPA. |
| Malaysia | Personal Data Protection Act 2010 (PDPA) | In Force (Amended) | Adds trade-union membership to standard categories, attracting stricter processing limits and limited lawful bases. |
| Morocco | Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data | In Force | Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health data, genetic data, or sexual orientation; these categories receive heightened protections. |
| Switzerland | Federal Act on Data Protection (FADP) — total revision | In Force | Plainly limits it to health, biometric, genetic, religious, political and criminal data subject to stricter restrictions. |
| Iceland | Act on Data Protection and the Processing of Personal Data No. 77/2018 | In Force | Plainly limits it to data revealing racial or ethnic origin, political opinions, religious beliefs, genetic data, biometric data, or health-related information. |
What it triggers
- In Ethiopia, processing of sensitive personal data is subject to stricter processing requirements and protections under the Proclamation.
- Under the Nigeria Data Protection Act, processing sensitive personal data triggers higher protection requirements, DPIAs where applicable, and stricter conditions for lawful processing and cross-border transfer.
- Under the Personal Data Protection Law (PDPL), processing of sensitive personal data is subject to stricter lawful-basis requirements and additional technical, organizational, and procedural controls.
- Under Taiwan's Personal Data Protection Act (PDPA), collection and processing of sensitive personal data is generally prohibited unless specific statutory conditions are met.
Definitions (16)
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health, genetic and biometric data, sexual orientation, and other categories designated as sensitive, which are subject to stricter processing requirements and protections under the Proclamation.
Special categories of personal data that require heightened safeguards, such as health information, biometric data, religious beliefs, and political opinions. Processing of this data is subject to stricter legal requirements under the Bill.
Personal data of a special nature that the Act treats as requiring enhanced safeguards (for example, health, biometric, or similarly sensitive categories); processing such data triggers higher protection requirements, DPIAs where applicable, and stricter conditions for lawful processing and cross‑border transfer.
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health data, genetic data, biometric data, sexual orientation, and other categories designated as sensitive by the law, which are subject to enhanced safeguards and stricter processing conditions.
A subset of personal data comprising specified categories that require heightened safeguards, such as health data, biometric and genetic data, financial and criminal data, and other categories listed by implementing regulations. Processing of sensitive personal data is subject to stricter lawful-basis requirements and additional technical, organizational, and procedural controls under the PDPL.
A subset of personal data that is treated with heightened protection under the PDPA, explicitly including medical records, genetic data, sexual health information, physical examination results, and criminal records; collection and processing of such data is generally prohibited unless specific statutory conditions are met.
A subset of personal data that includes categories requiring greater protection, such as health information, biometrics, religion, criminal records and other categories specified by the law; processing of sensitive personal data is subject to stricter conditions under the PDPA.
Categories of personal data that warrant default restrictions or heightened scrutiny, explicitly including health information, biometric data, unique identifiers, and data concerning minors. The Guide requires stricter handling, additional assessments, and typically prohibits permissive processing of such data for AI development unless exceptional safeguards and legal bases are documented.
Personal data related to private life or particularly sensitive attributes—such as beliefs, health, political opinions, origin, sexual life, and similar categories—whose processing is generally prohibited except where a clear legal basis or explicit consent and strict safeguards exist. The directive treats such data as requiring heightened protection and narrow, exceptional handling in procurement.
A subset of personal data relating to matters such as an individual's racial or ethnic origin, political opinions, religious beliefs, physical or mental health, sexual life, criminal records or other categories specified by the Act, which attract stricter processing limits and protections. Processing of such data is subject to additional legal safeguards and limited lawful bases under the Act.
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, health data, genetic data, or sexual orientation; these categories receive heightened protections and generally require prior authorization for processing.
A subset of personal data that includes categories such as health information, biometrics, financial data, religious beliefs and other protected characteristics, which the Bill treats as requiring heightened safeguards and stricter processing conditions.
A subset of personal data that includes categories such as health, biometric, genetic, religious, political and criminal data and that is subject to stricter processing restrictions and safeguards under the Act.
Personal data that require heightened protection due to their nature, including genetic, biometric and health data (and other categories specified in the ordinance), for which stricter processing conditions, safeguards and risk assessments apply.
Information regarding ethnic origin, political opinions, religious beliefs, health, or criminal records subject to strict processing rules.
Data revealing racial or ethnic origin, political opinions, religious beliefs, genetic data, biometric data, or health-related information.
Not to be confused with
Refers specifically to sensitive personal data subject to additional protections, using terminology aligned with GDPR-style laws.
Emphasizes highly sensitive data requiring explicit consent, potentially narrower than general sensitive personal data categories.
Questions and answers
What categories count as sensitive personal data in Ethiopia?
It includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health, genetic and biometric data, sexual orientation, and other designated categories.
Does processing sensitive personal data always require explicit consent?
No, jurisdictions vary; for example, Taiwan's PDPA generally prohibits processing unless statutory conditions are met, while others impose stricter conditions without mandating explicit consent.
What extra steps are needed for sensitive personal data under the Nigeria Data Protection Act?
Processing triggers higher protection requirements, DPIAs where applicable, and stricter conditions for lawful processing and cross-border transfer.
Related Terms
Sensitive data (special categories)
Personal data revealing protected characteristics....
Special Categories of Personal Data
Sensitive personal data subject to additional protections....
Sensitive personal information
Highly sensitive personal data requiring explicit consent....
Personal data of a special nature
Sensitive categories requiring extra protection and permissions....
Sensitive Data
Data requiring stricter protection due to privacy risks....