Rights & Ethics

Sensitive personal information

Highly sensitive personal data requiring explicit consent.

How the laws define this

Global regulators agree that sensitive personal information constitutes a high-risk category of personal data—consistently encompassing health and medical details—that demands heightened security measures and stricter processing conditions. The primary point of divergence lies in how these instruments define the scope of sensitivity and the specific obligations imposed on data controllers. The Data Privacy Act of 2012 (Republic Act No. 10173) relies on an exhaustive catalog of specific individual traits, including age, marital status, color, education, and offense proceedings, requiring explicit consent or legal authorization. Conversely, the Personal Information Protection Law of the People's Republic of China (PIPL) and An Act to modernize legislative provisions as regards the protection of personal information (Law 25) introduce harm-based criteria centered on risks to personal dignity, safety, or intimate privacy. Furthermore, the Personal Information Protection Law of the People's Republic of China (PIPL) uniquely mandates separate consent and covers specific identities, whereabouts, financial accounts, biometrics, and details of minors under 14, whereas Law 25 focuses on financial situations, biometrics, and intimate information carrying a higher risk of harm upon disclosure.

Synthesised from the 3 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first. Showing 2 of the 3 instruments that define this term; all are listed under Definitions below.

Jurisdiction	Instrument	Status	What is distinctive
China	Personal Information Protection Law	In Force	Explicitly lists biometrics, medical health, financial accounts, religious beliefs, specific identity, whereabouts, and minors under 14 as examples, and ties sensitivity to risks of infringing dignity or endangering safety.
Philippines	Data Privacy Act of 2012 (Republic Act No. 10173)	In Force	Enumerates race, ethnic origin, marital status, age, color, religious, philosophical or political affiliations, health, education, genetic or sexual life, and criminal proceedings.

What it triggers

In China, under the Personal Information Protection Law, processing requires separate consent and stricter protective measures.source
In Quebec, Canada, under Law 25, processing carries a higher risk of harm and mandates explicit consent.source
In the Philippines, under the Data Privacy Act of 2012, processing generally requires explicit consent or specific legal authorization.

Definitions (3)

A subset of personal information that includes race, ethnic origin, marital status, age, color, religious, philosophical or political affiliations, health, education, genetic or sexual life, and any proceedings for offenses committed or alleged to have been committed; these categories receive heightened protection and generally require explicit consent or specific legal authorization to process.

Data Privacy Act of 2012 (Republic Act No. 10173)Definition 1 of 3

Personal information that, once leaked or illegally used, may easily infringe upon personal dignity or endanger personal or property safety, including biometrics, medical health, financial accounts, religious beliefs, specific identity, whereabouts, and personal information of minors under 14. Processing of such data requires separate consent and stricter protective measures.

Personal Information Protection Law of the People's Republic of China (PIPL)Definition 2 of 3

Includes data related to an individual's health, biometric characteristics, financial situation, or any other information of an intimate nature, where disclosure carries a higher risk of harm.

An Act to modernize legislative provisions as regards the protection of personal information (Law 25)Definition 3 of 3

Not to be confused with

Sensitive personal data

Sensitive personal data refers more generally to personal data needing enhanced protections, while this term specifies categories like biometrics or health with explicit consent rules.

special personal information

Special personal information denotes sensitive categories requiring stricter protection, similar to this term but potentially varying by jurisdiction-specific lists.

Questions and answers

What counts as sensitive personal information under China's PIPL?

It includes biometrics, medical health, financial accounts, religious beliefs, specific identity, whereabouts, and personal information of minors under 14. Leakage or illegal use may infringe dignity or endanger safety.

Does Quebec's Law 25 define sensitive personal information?

Yes, it includes health, biometric characteristics, financial situation, or any intimate information where disclosure risks higher harm.

What are examples of sensitive personal information in the Philippines?

Examples include race, ethnic origin, marital status, age, color, religious or political affiliations, health, education, genetic or sexual life, and criminal proceedings.