Sensitive data is a special category of personal data under the GDPR.

The following types of information fall under this definition:

  • health data
  • racial or ethnic origin
  • religious beliefs
  • sexual orientation
  • trade-union memberships
  • political opinions
  • biometric data

As a Data controller , you must meet the following conditions in order to process sensitive data:

  • You must obtain user consent
  • The processing is necessary to protect the vital interests of the data subject when one is unable to give consent
  • The data subject has revealed the sensitive data publicly
  • It is necessary for claims or in a legal process
  • Processing the data for reasons of substantial public interest on the basis of EU or national law
  • You are processing the data for preventive or occupational medicine
  • The processing is required for public health reasons – preventing epidemics, etc.

For more details we recommend reading this article prepared by the European Commission.

What’s more, such data requires special protection from unauthorized access to ensure that the privacy and security of both individuals and companies is properly guarded. You can read about this here.


  • EU hosting vs. EU sovereignty: Why the difference matters for privacy-first analytics

    As EU-US data transfer tensions continue to evolve, driven by legal uncertainties and heightened regulatory scrutiny, organizations are under increasing pressure to make informed decisions about where and how their analytics data is stored. The collapse of previous data transfer frameworks and the uncertain future of the current EU-U.S. Data Privacy Framework have made one…

  • Why Shopify stores need privacy-compliant analytics

    Shopify store owners depend on analytics to track sales, understand customer behavior, and measure marketing performance. However, as privacy regulations like GDPR, CCPA, and the ePrivacy Directive evolve — and as consumers become more aware of how their data is used — traditional analytics platforms pose increasing risks. Tools that rely on third-party cookies and…