Sensitive and Special Categories of Personal Information
5 minutes
5 Questions
In the Certified Data Privacy Solutions Engineer (CDPSE) framework, Privacy Governance means defining and managing personal information according to its risk level. Sensitive and special categories of personal information are data types whose misuse could cause significant harm to individuals, such…In the Certified Data Privacy Solutions Engineer (CDPSE) framework, Privacy Governance means defining and managing personal information according to its risk level. Sensitive and special categories of personal information are data types whose misuse could cause significant harm to individuals, such as discrimination, identity theft, financial loss, reputational damage, or threats to physical safety. Because of this elevated risk, laws and regulations require stronger protections for them. Under the EU General Data Protection Regulation (GDPR), Article 9 defines special categories as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for unique identification, health data, and data about sex life or sexual orientation. Processing these categories is generally prohibited unless a specific exception applies, such as explicit consent, employment obligations, vital interests, substantial public interest, or medical purposes. Criminal conviction data is handled separately under Article 10. Other jurisdictions define sensitive data differently. The California CPRA, for example, includes Social Security numbers, financial account credentials, precise geolocation, and the contents of private communications. Sector laws such as HIPAA also impose heightened protections. From a governance perspective, organizations must first identify and classify sensitive data through data inventories and data mapping. They must then establish policies that define a lawful basis for processing, limit collection to what is strictly necessary, and restrict access on a need-to-know basis. Data Protection Impact Assessments (DPIAs) are often mandatory when sensitive data is processed at scale. For CDPSE practitioners, technical controls are central to this work. These include encryption at rest and in transit, pseudonymization, tokenization, strict role-based access controls, data loss prevention, and detailed audit logging. Privacy by design requires building these safeguards into systems from the outset. Retention schedules, secure deletion, vendor oversight, and breach response plans complete the lifecycle. Effective governance aligns legal requirements, organizational accountability, and engineering controls so that sensitive information receives protection proportional to its risk.
Sensitive and Special Categories of Personal Information (CDPSE - Privacy Governance)
Overview Sensitive and special categories of personal information are types of personal data whose misuse, exposure or unauthorized processing could cause significant harm to individuals. Examples of harm include discrimination, financial loss, physical danger, reputational damage or loss of fundamental rights.
For the ISACA Certified Data Privacy Solutions Engineer (CDPSE) exam, this topic sits within the Privacy Governance domain. It is also tested in the Privacy Architecture and Data Lifecycle domains. You are expected to identify these data types, understand the heightened legal and technical obligations they carry, and choose the most appropriate governance and control response in scenario-based questions.
Why It Is Important 1. Higher risk of harm: Disclosure of health conditions, sexual orientation, religious beliefs or biometric templates can lead to the following: - discrimination in employment or insurance - social exclusion - persecution - identity theft, which may be irreversible (a fingerprint cannot be changed like a password)
2. Stricter legal requirements: Most privacy laws impose additional conditions on these data types: - GDPR Article 9: processing of special category data is prohibited unless a specific exception applies. - GDPR Article 10: criminal conviction data is handled separately. - CCPA/CPRA: defines sensitive personal information and gives consumers the right to limit its use. - Brazil's LGPD: defines sensitive personal data. - HIPAA: regulates protected health information (PHI) in the U.S.
3. Regulatory penalties and enforcement focus: Regulators treat violations involving sensitive data as aggravating factors. Fines and enforcement actions tend to be higher.
4. Trust and reputation: Breaches involving sensitive data generate greater public outrage and loss of customer trust.
5. Drives privacy engineering decisions: The presence of sensitive data influences the following: - data classification - encryption strength - access controls - retention periods - the need for Data Protection Impact Assessments (DPIAs) - vendor due diligence - cross-border transfer decisions
What It Is Personal information (PI) / personal data: Any information relating to an identified or identifiable natural person.
Sensitive / special category data: A subset of personal data requiring enhanced protection because of its nature.
GDPR Article 9 special categories: - Racial or ethnic origin - Political opinions - Religious or philosophical beliefs - Trade union membership - Genetic data - Biometric data processed for the purpose of uniquely identifying a person - Health data (physical or mental) - Data concerning a person's sex life or sexual orientation
Related but separately treated under GDPR: - Criminal convictions and offences (Article 10). This data may only be processed under official authority or when authorized by Union or Member State law. - National identification numbers (Article 87). Member States may set specific conditions.
CPRA 'Sensitive Personal Information' includes: - Social Security, driver's license, state ID or passport numbers - Account log-in, or financial account/debit/credit card numbers combined with security codes or passwords - Precise geolocation - Racial or ethnic origin, religious or philosophical beliefs, union membership - Contents of mail, email and text messages, unless the business is the intended recipient - Genetic data - Biometric data processed to identify a consumer - Health information - Sex life or sexual orientation information
Other commonly recognized sensitive data: - Financial information (bank account, credit card, credit history; see PCI DSS and GLBA) - Children's data (COPPA in the U.S.; GDPR Article 8 on age of consent for information society services) - Authentication credentials - Precise location data - Immigration status
Key concept, context matters: Data can become sensitive through inference or combination. For example: - Purchase history may reveal pregnancy. - Location data may reveal visits to a religious site or clinic. - A photograph becomes biometric data only when processed through specific technical means to uniquely identify someone.
On the exam, recognize that inferred sensitive data should be treated as sensitive.
How It Works 1. Identification and discovery - Conduct data inventory and data mapping (records of processing activities). - Use automated data discovery and classification tools to locate sensitive data in structured and unstructured repositories. - Tag data elements with classification labels, for example: Public, Internal, Confidential, Restricted/Sensitive.
2. Establish a lawful basis plus an additional condition Under GDPR, you need both: - an Article 6 lawful basis, and - an Article 9(2) exception.
Common Article 9(2) exceptions: - Explicit consent of the data subject - Obligations in employment, social security and social protection law - Vital interests, where the subject is incapable of giving consent - Legitimate activities of not-for-profit bodies with a political, philosophical, religious or trade union aim, relating to members - Data manifestly made public by the data subject - Establishment, exercise or defence of legal claims - Substantial public interest under law - Preventive or occupational medicine, health and social care - Public health - Archiving, scientific or historical research, or statistical purposes
Important:Explicit consent is a higher standard than ordinary consent. It requires a clear affirmative statement, often written or confirmed separately.
3. Conduct a Privacy/Data Protection Impact Assessment Large-scale processing of special category data is a trigger for a mandatory DPIA under GDPR Article 35. The DPIA does the following: - identifies risks - evaluates necessity and proportionality - documents mitigating controls
4. Apply data minimization and purpose limitation - Collect only the sensitive data strictly necessary for the stated purpose. - Avoid secondary uses unless they are compatible and lawful. - Under CPRA, consumers can limit use of sensitive data to what is necessary to provide the requested goods or services.
5. Implement enhanced technical controls - Strong encryption at rest and in transit, with robust key management - Pseudonymization, tokenization, or anonymization where feasible - Role-based and attribute-based access control following least privilege and need-to-know - Multi-factor authentication for access to sensitive repositories - Data loss prevention (DLP) - Logging, monitoring and alerting on access - Segregation of sensitive datasets - Masking in non-production environments; test environments should not use real sensitive data - Privacy-enhancing technologies such as differential privacy and secure multiparty computation
6. Implement enhanced administrative controls - Policies and standards specific to sensitive data handling - Training for staff who handle sensitive data - Vendor/processor due diligence and contractual clauses (Data Processing Agreements, Business Associate Agreements under HIPAA) - Shorter retention periods and secure disposal - Appointment of a DPO where core activities involve large-scale processing of special categories (GDPR Article 37)
7. Transparency and data subject rights - Privacy notices must clearly disclose the collection and use of sensitive data. - Provide mechanisms to withdraw consent, opt out, or limit use. CPRA requires a 'Limit the Use of My Sensitive Personal Information' link or an alternative mechanism.
8. Breach response Breaches involving sensitive data are more likely to meet the 'high risk' threshold. That threshold triggers notification to individuals, in addition to the regulator.
9. Cross-border transfers Sensitive data transfers receive heightened scrutiny. Transfer Impact Assessments and supplementary measures are often needed.
10. Monitoring and audit Regularly review the following: - access rights - the classification accuracy - the effectiveness of controls protecting sensitive data
Practical Example A wellness app collects heart rate, sleep patterns and mood entries. These are health data, and therefore special category data under GDPR. A privacy engineer would do the following: - classify the data as sensitive - obtain explicit consent - perform a DPIA - encrypt data on device and in the cloud - pseudonymize data used for analytics - restrict employee access - prohibit sharing with advertisers unless separate explicit consent is obtained - set clear retention limits - provide easy consent withdrawal
Exam Tips: Answering Questions on Sensitive and Special Categories of Personal Information Tip 1: Memorize the lists. Know the GDPR Article 9 categories and the CPRA sensitive PI list. Questions often ask which item is NOT a special category. For example, under GDPR the following are personal data but not Article 9 special categories: - name - email address - IP address - financial data - criminal records, which are handled separately under Article 10
Tip 2: Watch the biometric nuance. A photo is not automatically biometric special category data. It becomes so when processed with specific technical means to uniquely identify a person.
Tip 3: Look for 'explicit consent'. When a question asks for the appropriate basis for processing sensitive data, prefer answers mentioning explicit consent or another valid Article 9 exception over 'legitimate interests'. Legitimate interests alone is NOT sufficient for special category data under GDPR.
Tip 4: DPIA is a strong answer. If a scenario involves new or large-scale processing of sensitive data, new technology, or profiling, conducting a DPIA/PIA is often the BEST FIRST step.
Tip 5: Identify and classify first. CDPSE questions frequently ask what to do FIRST. You cannot protect what you have not identified, so data discovery, inventory and classification usually come before applying controls.
Tip 6: Prefer minimization over protection. The best way to reduce risk is often to not collect the sensitive data at all, or to de-identify it. Encrypting data you don't need is inferior to not collecting it.
Tip 7: Think 'privacy by design and by default'. Answers that embed protections early in the system development lifecycle are generally better than answers that bolt on controls after deployment.
Tip 8: Recognize inference risk. If a scenario shows non-sensitive data that could reveal sensitive attributes, treat the result as sensitive.
Tip 9: Know the governance roles.
- The data owner (business) is accountable for classification decisions. - The DPO/privacy officer advises and monitors. - Data custodians and engineers implement controls.
Tip 10: Distinguish anonymization from pseudonymization. Pseudonymized sensitive data is still personal (and sensitive) data under GDPR. Only truly anonymized data falls outside the scope of the regulation.
Tip 11: Mind non-production environments. Using real sensitive data in testing or development is a classic exam red flag. The preferred answer is data masking or synthetic data.
Tip 12: Breach questions. Exposure of sensitive data raises the likelihood that notifying affected individuals is required, not just the authority. Note that strong encryption with uncompromised keys may reduce notification obligations.
Tip 13: Children's data. Treat it as requiring enhanced protection, with parental consent mechanisms and age verification considerations.
Tip 14: Eliminate extreme or incomplete answers. Discard options that rely solely on one control, such as 'encrypt everything' or 'just get consent'. CDPSE favors a risk-based, layered approach aligned with legal requirements and business purpose.
Tip 15: Keywords to spot. These signal special category issues: - 'health' - 'genetic' - 'fingerprint' - 'facial recognition' - 'union' - 'religion' - 'ethnicity' - 'sexual orientation' - 'precise geolocation' - 'SSN'
Mentally switch to 'heightened requirements' mode whenever you see them.
Summary Sensitive and special categories of personal information are high-risk data types that demand stricter legal justification and stronger safeguards. In practice, the governance lifecycle is: 1. Identify and classify the data. 2. Establish a valid legal basis and condition. 3. Assess risk through a DPIA. 4. Minimize the data. 5. Protect it with layered controls. 6. Remain transparent. 7. Monitor continuously.
On the CDPSE exam, choose answers that are risk-based, legally grounded, preventive and embedded early through privacy by design.
