If your business collects and processes personal data, it’s important to know the difference between personal information and sensitive personal information, since the latter involves additional requirements and security measures.
In this guide, we’ll explain the difference between personal and sensitive personal information, show you examples of sensitive information under different privacy laws, and give you tips on handling sensitive data.
When we talk about personal information in the context of data protection laws, we generally refer to information that relates to an identified or identifiable individual. This definition also includes partial information that, when collected together, can lead to the identification of a person.
Examples of personal information are:
and more.
Even pseudonymized or encrypted data can be considered personal information, if the the encryption/anonymization is reversible.
Sometimes you may read personal data instead of personal information. Don’t worry: they are the same thing. The use of one term over the other usually depends on the law we are referring to. For example, the EU GDPR uses “personal data”, while the California CCPA uses “personal information”. In this article, we’ll use both terms interchangeably.
When we talk about sensitive personal information (also called SPI), we refer to special categories of personal information that should be handled more carefully because they could lead to discrimination or similarly significant consequences for the individual, if shared.
International laws on data privacy may have different views on sensitive data. Anyway, there is one common ground: all the laws agree that you should collect and process sensitive data only if they are really necessary to your activity. If you do need to collect sensitive information, then you should store it securely and with the utmost care.
Examples of sensitive personal data are:
As you understand, the main difference between personal information and sensitive personal information lies in their nature and risk level.
Personal information is any data that could lead to the identification of a person, and it’s generally considered lower risks. On the other hand, sensitive personal information includes data that, if disclosed, could cause harm or discrimination. For this reason, sensitive data is subject to stricter legal requirements and needs higher protection.
| Aspect | Personal Information (PI) | Sensitive Personal Information (SPI) |
|---|---|---|
| Nature | Basic identifying data | High-risk, private, or potentially harmful data |
| Risk Level | Low to moderate | High |
| Protection Requirements | Standard measures | Enhanced security and compliance requirements |
Though very similar, privacy laws around the world have different definitions of what is considered sensitive personal information. Let’s take a closer look.
The GDPR, defines sensitive data in Article 9 under “special categories of personal data”, as:
The DPA 2018 sets out the framework for data protection law in the UK. According to the ICO, it sits alongside and supplements the UK GDPR. Its definition of special category data is the same as the GDPR (listed above).
The CPRA is an amendment to the CCPA, which was initially developed to regulate the collection and sale of consumers’ personal information in California.
Amongst other things, a new category of protected data was introduced by the CPRA, sensitive personal information (SPI). This idea is similar to the GDPR’s special categories mentioned above and requires a higher level of protection.
The VCDPA is the privacy law in the Commonwealth of Virginia. It states that a business cannot process sensitive data concerning a consumer, without obtaining the consumer’s prior consent (opt-in).
It defines sensitive data as a category of personal data that includes:
The Colorado Privacy Act governs the processing of personal and sensitive data in the State of Colorado. Like in Virginia, consent (opt-in) is required before processing any sensitive data and controllers are required to conduct data protection assessments.
The definition of sensitive data under the CPA is very similar to the VCDPA :
There are many more effective privacy laws in the US, with their own definition of sensitive personal information. Check our full overview here 👉 US State Comparison
The LGPD identifies sensitive data as a special category of personal data. Sensitive data is any data related to racial or ethnic origin, religious belief, political opinion, health or sexual life data; or data that allows the unequivocal and persistent identification of the user, such as genetic or biometric data.
If your business collects and processes sensitive data, you may need to take extra steps to make sure you’re storing them securely.
Here’s what you may need to do:
A key principle of data privacy laws is data minimization, that is limiting your processing to only the data you truly need for your purposes.
The first thing you need to do, before you start collecting sensitive data, is to have a precise idea of your processing activities. This step is useful because it clarifies exactly how you’re going to use the data. Keeping accurate records of your processing activities can help you here, because you can go back to them whenever you need to.
After going through your records, you will know the amount of data you need to fulfill your purposes, and how long you’ll need to store them.
If you’ve determined that you do need to process sensitive personal information, then continue to point 2.
Each privacy law has different requirements, even when it comes to sensitive information.
If you’re not sure what to do, the safest approach would be to follow the strictest requirements.
Storing personal data safely it’s key to compliance with privacy laws, especially when we talk about sensitive personal data.
Here are a few tips:
Sensitive personal information needs to be processed in the safest way possible, to avoid its unwanted disclosure. Remember that sharing this information could potentially lead to harm and discrimination, so make sure that you really need this data before starting to process it.
Complying with data protection laws can be challenging, but not with the right tools!
Here’s how iubenda can help if you’re processing sensitive data:
Attorney-level solutions to make your websites and apps compliant with the law across multiple countries and legislations.