Sensitive Data

The exact scope of 'sensitive data' varies by regime. GDPR Article 9 'special categories' covers racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, and data concerning sex life or sexual orientation — all processing of these requires an Article 9 condition in addition to an Article 6 lawful basis. CPRA defines 'sensitive personal information' as a specific list including SSN, financial account credentials, precise geolocation, racial / ethnic origin, religion, union membership, communications contents, genetic data, biometric data and health or sex-life data; consumers have a right to limit its use.

The DPDP Act does not create a separate sensitive-data category — personal data is personal data under one unified framework — though Rule 10 adds protections for a child or person with disability. PDPA Singapore distinguishes NRIC/foreign-ID numbers and prescribed personal data with its own handling rules. For a global programme, maintaining a classification tier that captures the strictest treatment required across all applicable regimes (effectively, the GDPR Article 9 list plus the CPRA sensitive list plus local extras) is the operational baseline.