Personal Data vs. ”Sensitive” Personal Data

Q1. When is personal data considered sensitive?

The GDPR (General Data Protection Regulation) makes a distinction between “personal data” and “sensitive personal data.” Personal data means any information relating to an identified or identifiable neutral person (data subject). Meanwhile, sensitive personal data is a specific set of “special categories” of personal data that must be treated with extra care.

Q2. Under what conditions can a company/organisation process sensitive data?

According to the GDPR, a company/organisation can only process ”sensitive” data if one of the following is met:

• Consent: when the data subject agrees to the processing when presented with a clear explanation of the personal data that will be collected and what it will be used for. 
• A contract with the individual: for example, to supply goods or services they have requested or to fulfil an obligation under an employee contract. 
• Vital interests: for example, when processing data will protect someone’s physical integrity or life (either the data subject’s or someone else’s). 
• A public task: for example, to complete official functions or tasks in the public interest. This will typically cover public authorities such as government departments, schools and other educational institutions; hospitals; and the police. 

A complete list is available in Article 6 and Article 9 of the GDPR.