Sensitive personal data / information
Higher-risk data such as health, biometrics, beliefs, precise location, or credentials that gets extra legal and security protection.
What it is
Sensitive personal data is the higher-risk layer of personal information, but the exact list depends on the law. GDPR calls race or ethnicity, politics, religion or beliefs, union membership, genetic data, biometric data used for unique identification, health, sex life, and sexual orientation 'special categories' under Article 9. California's 'sensitive personal information' overlaps but also includes items such as account credentials, precise geolocation, government identifiers, and the contents of private communications. The labels are related, not interchangeable.
Classify it at collection and apply the extra rule for the jurisdiction: an Article 9 condition in addition to a GDPR Article 6 basis, or California's limits and consumer rights where they apply. Minimize it, separate access, shorten retention, audit use, and run a DPIA when the planned processing is likely to create high risk.
Gotcha: encryption protects the data but does not make it non-sensitive. Sensitive material also hides in free-text support tickets, filenames, images, model prompts, and inferences, so scanning only neatly named database columns misses the places most likely to leak.
Ask AI for it
Classify sensitive personal data across this codebase under GDPR Article 9 and California sensitive personal information rules. Inspect PostgreSQL schemas, OpenAPI request bodies, file uploads, model prompts, Segment events, logs, and Sentry SDK beforeSend handling. Produce a table with the field, source, jurisdictional category, Article 6 basis, separate Article 9 condition where required, purpose, access group, retention, recipients, and deletion path. Add controls for field-level encryption, least-privilege access, redaction before telemetry, and free-text detection, then flag every sensitive field with no documented need or no valid extra condition.