Sensitive data is a broad term for information whose disclosure, misuse, alteration or unauthorised access could cause significant harm, discrimination, privacy intrusion, security consequences or other serious adverse effects. The term does not have one universal technical or legal definition. In ordinary information-security usage, it can include confidential business information, credentials, financial records, health information, personal identifiers and other information requiring enhanced protection.
In legal data-protection contexts, terms such as special-category data may have precise statutory meanings that differ from the broader phrase sensitive data. Therefore, whether information is “sensitive” should be determined according to the applicable legal framework, organisational classification policy, context and potential consequences rather than assuming that every use of the word has the same meaning.
In the United Kingdom and European data-protection context, a particularly important formal category is special-category personal data under the UK GDPR and EU GDPR. This includes data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used for uniquely identifying an individual, health data and information concerning a person's sex life or sexual orientation.
Processing such information generally requires an ordinary lawful basis plus an applicable additional condition under the relevant legal framework. Criminal-offence information is handled under separate rules. This formal distinction is important because “sensitive data” in an organisational policy may include many categories that are not legally special-category data, such as ordinary passwords or confidential financial forecasts.
Sensitive information can also include security credentials and authentication secrets. Passwords, private cryptographic keys, recovery codes, API credentials, session tokens and other authentication material can create severe security consequences if exposed. These items may not always constitute special-category personal data, but they commonly receive high security classifications because compromise can enable unauthorised access or further attacks. Proper handling can include hashing passwords using appropriate password-hashing algorithms, protecting keys in dedicated secret-management systems, rotating credentials and restricting access according to least privilege. Logging systems should also avoid accidentally recording secrets. Sensitivity is therefore closely related to potential harm and security impact, not solely to privacy law.
Financial and commercial information can also be sensitive. Bank-account details, payment information, tax records, credit information, salary data, financial forecasts, acquisition plans, trade secrets and confidential contracts may require strict controls. Some of these categories can be personal data when they relate to individuals, while others are confidential corporate information. The appropriate safeguards depend on the information and risk. Encryption, access controls, segregation, monitoring, retention rules and secure disposal can all be relevant. An organisation may use data-classification levels such as public, internal, confidential and highly confidential to communicate handling expectations, although classification labels and thresholds vary between organisations.
Sensitivity can be contextual. A person's public business email address may present relatively low confidentiality risk in one context, while the same person's private contact information combined with location history may create substantial privacy and safety risks. A dataset containing apparently ordinary demographic fields can become sensitive when combined with other information that enables detailed profiling or identification. Similarly, technical logs may appear harmless individually but become sensitive when they reveal credentials, internal network architecture or detailed user behaviour. Data classification should therefore consider combinations of fields, likely threats, potential consequences and the environments in which information is stored and processed.
Sensitive data requires controls proportionate to its risks. Common measures include strong authentication, role-based or attribute-based access control, encryption at rest and in transit, key management, pseudonymisation, data minimisation, secure backups, monitoring, incident-response procedures and retention limits. Access should follow least privilege so that people and systems receive only the permissions necessary for their roles. Sensitive datasets should also be included in security testing and breach-response planning. Controls should protect confidentiality, integrity and availability because sensitive information can be harmed by unauthorised modification or destruction as well as by disclosure.
Sensitive data is easily confused with personal data, confidential data and special-category data. Personal data concerns information relating to an identifiable living individual; it can be sensitive or relatively routine. Sensitive data is broader and can include non-personal corporate secrets. Special-category data is a specific legal classification with defined contents and additional processing requirements in certain jurisdictions. Confidential data describes information whose disclosure is restricted, but confidentiality alone does not determine whether information is personal or legally special. These categories overlap, but none should automatically be treated as interchangeable. A password, for example, is highly sensitive from a security perspective but is not necessarily special-category personal data.
There is no universal list of sensitive data because risk depends on context, jurisdiction and organisational purpose. A healthcare provider, financial institution, software company and government department may classify different information as sensitive because their threats and legal obligations differ. Effective classification frameworks define categories and handling rules clearly, identify owners, document retention requirements and apply controls consistently.
Automated discovery tools can scan repositories for likely sensitive fields, but classification often requires contextual judgement because patterns alone cannot always establish sensitivity. The fundamental principle is to identify information whose compromise or inappropriate processing could produce meaningful harm or violate legal, contractual or organisational obligations, then apply proportionate safeguards throughout its lifecycle.
