Table of contents
- What is personal data
- What is sensitive data (special categories of data)
- Difference between personal and sensitive data
- How data must be processed
- Security measures to protect data
- Legal bases for data processing
- Protecting vital and public interests
Do you really know what distinguishes personal data from sensitive data? In a world where we share personal information daily through digital platforms, apps, social networks, and online forms, it’s crucial to understand that not all data enjoys the same level of protection.
The European Regulation 2016/679 (GDPR) clearly defines what is meant by personal data and sensitive data, specifying how such information must be processed and what security measures must be adopted to protect it.
In this in-depth article, we will explain the difference between personal and sensitive data, what type of information falls under the category of special data, when explicit consent is required, and how the law protects individuals in cases of misuse or data breaches.
What is personal data
According to the GDPR, personal data refers to any information relating to an identified or identifiable natural person. This means that any element that allows, directly or indirectly, the identification of an individual falls into this category.
Common examples of personal data include:
- first name, last name, and address;
- phone number, email, tax code;
- IP address, geolocation data, and identifying cookies.
Personal data can also identify someone indirectly, when combined with other information.
Example
A customer ID or health card number becomes personal data if, through a database, it allows the individual to be identified.
Information relating to legal entities (companies, institutions, or associations) is not considered personal data, unless it includes an identifiable individual — for instance, “mario.rossi@company.it”.
What is sensitive data (special categories of data)
The so-called sensitive data, now referred to by the GDPR as special categories of data, include all information that reveals intimate aspects of a person and, if disclosed or misused, could cause discrimination or serious harm.
This category includes data revealing:
- racial or ethnic origin;
- political opinions;
- religious or philosophical beliefs;
- trade union membership;
- genetic data;
- biometric data used to identify a person;
- health-related data;
- sex life or sexual orientation.
These are therefore personal details requiring much stricter protection.
The processing of such data is prohibited, except in specific cases — for instance, when the person has given explicit consent, or when processing is necessary to protect a vital interest or for reasons of substantial public interest, such as public health or national security.
Difference between personal and sensitive data
The difference between personal and sensitive data lies in the nature of the information and the level of protection required.
- Personal data identifies or makes an individual identifiable (e.g., name, address, phone number).
- Sensitive or special data, on the other hand, reveal deeper aspects of one’s identity, such as health status, religious faith, ethnic origin, or sexual orientation.
Example
The email address “maria.bianchi@gmail.com” is personal data, but a medical report or genetic test are sensitive data, because they belong to the most private sphere of a person’s life.
This distinction also affects data processing: for personal data, informed consent is usually sufficient, while sensitive data require explicit consent, expressed in writing or through a clear affirmative action. Stronger security measures such as encryption, pseudonymization, and controlled access must also be applied.
How data must be processed
The processing of data includes every operation related to managing information: collection, recording, consultation, storage, alteration, disclosure, and deletion.
Every processing activity must comply with the fundamental principles of the GDPR: lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, integrity, and confidentiality.
Anyone processing personal and sensitive data must:
- Identify a valid legal basis (consent, contract, legal obligation, public interest).
- Limit data collection to what is strictly necessary.
- Apply appropriate technical and organizational security measures.
- Store data only for as long as necessary for the purpose.
- Allow the data subject to exercise their rights (access, rectification, erasure, portability, objection).
For special categories of data, it is often mandatory to conduct a Data Protection Impact Assessment (DPIA) and to appoint a Data Protection Officer (DPO).
Security measures to protect data
The protection of sensitive and personal data is a cornerstone of modern cyber security. Companies and public authorities must adopt appropriate security measures, both technical and organizational.
Among the most important are:
- Data encryption, to prevent access by unauthorized parties.
- Pseudonymization, replacing identifying information with anonymous codes.
- Access controls, ensuring only authorized personnel can view or modify data.
- Backup and disaster recovery, to guarantee data availability even in case of cyber incidents.
- Staff training, essential to reduce human error and accidental breaches.
In the event of a data breach, the data controller must notify the Supervisory Authority within 72 hours and inform affected individuals if the risk to their rights is deemed high.
Legal bases for data processing
The GDPR establishes that the processing of personal and sensitive data is lawful only if based on a valid legal ground.
For personal data, the main bases are:
- consent of the data subject;
- contractual or legal obligation;
- legitimate interest of the controller;
- public interest.
For sensitive data, processing is allowed only if:
- the data subject has given explicit consent;
- processing is necessary to protect a vital interest;
- it is justified by reasons of substantial public interest;
- it is required for the establishment or defense of legal claims.
This framework aims to balance the freedom of processing with the protection of fundamental human rights.
Protecting vital and public interests
The GDPR allows exceptions to consent when the processing of sensitive data is necessary to protect a vital interest or for public interest reasons.
Example
The healthcare sector: a doctor may process a patient’s health data in an emergency, even without consent, to save their life.
Similarly, public bodies or organizations may process genetic or biometric data to ensure national security, prevent epidemics, or provide social protection always in compliance with principles of proportionality and transparency.
In summary
Understanding the difference between personal and sensitive data is essential to live responsibly in today’s digital world. Every time we browse online, fill out a form, or download an app, we entrust part of our identity to third parties.
Knowing which data categories we are sharing, how they must be processed, and what security measures protect us is the only way to defend our right to privacy and personal freedom.
Respect for privacy is not optional it is a fundamental right that safeguards human dignity, increasingly threatened by an economy driven by data.
Questions and answers
- What is personal data?
Any information that identifies a person, such as name, email, tax code, or IP address. - What is sensitive data?
Data revealing private aspects such as ethnic origin, political opinions, health, or sexual orientation. - What is the difference between personal and sensitive data?
Personal data identifies a person; sensitive data reveals deeper, more private aspects that require stronger protection. - Are biometric data considered sensitive?
Yes, because they uniquely identify an individual. - When can sensitive data be processed without consent?
Only for vital or public interest reasons, such as during medical emergencies. - Who is responsible for data processing?
The data controller and, if appointed, the Data Protection Officer (DPO). - Must consent always be in writing?
For sensitive data, yes it must be explicit and unambiguous. - Can I request the deletion of my data?
Yes, through the right to be forgotten under the GDPR. - What happens in case of a data breach?
The organization must notify the supervisory authority and affected individuals within 72 hours. - What does it mean to protect a vital interest?
Processing data to safeguard someone’s life or health when they are unable to give consent.
