Sensitive data (special categories)

The special categories of personal data in Article 9 of the GDPR: racial or ethnic origin, political, religious or philosophical beliefs, trade union membership, genetic and biometric data, health data, and data concerning sex life or sexual orientation. Processing is prohibited by default and requires a specific exception, such as explicit consent or necessity under employment law. Sensitive data demands heightened security, and in Danish law national ID numbers and criminal records are governed by their own separate rules. Many HR and whistleblower cases contain sensitive data and therefore need extra protection.