⚠️Sensitive Data

NEW

Also known as: Confidential Data

Information whose unauthorized disclosure, alteration, or loss could cause harm and therefore requires heightened protection and controls.

DESCRIPTION

Sensitive data includes personal, financial, health, and proprietary information requiring strong safeguards. Organizations classify sensitivity levels (e.g., public, internal, confidential) to guide controls. Legal regimes and contracts often mandate protection and retention rules. Controls span encryption, masking, access management, monitoring, and secure disposal. Periodic reassessment is essential as business context and threats evolve.

ALTERNATIVE DEFINITIONS

NIST CSRC Glossary

Information that, if lost, misused, or accessed without authorization, could adversely affect national or organizational interests or individuals.

Risk-based, harm-focused definition.

Source

GDPR (EU) 2016/679

‘special categories of personal data’ reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic, biometric or health data.

Defines especially sensitive subcategories under EU law.

Source

RELATED TERMS

PII Protected Health Information Payment Card Industry Data Security Standard Trade Secret Data Classification Data Encryption Access Control Data Loss Prevention GDPR Data Retention

COMPETING TERMS

Public Data Non-sensitive Data

RELATIONS

• Broader: Data

KNOWLEDGE AREAS

Data Security Data Privacy & Compliance Data Management

TARGET AUDIENCE

Data Governance Manager Data Steward Data Architect Chief Information Officer DevOps Engineer

EXTERNAL SOURCES

• Wikipedia - Sensitive Data
• PCI Security Standards Council - Payment card data protection
• NIST - Authoritative sensitive info definition
• UK ICO - Special category data guidance

TOP QUESTIONS

What types of information are considered Sensitive Data?

Common categories include PII, PHI, payment card data, credentials, and trade secrets. Sensitivity depends on context and potential harm from disclosure.

Category: Example

How is Sensitive Data classified in organizations?

Organizations adopt tiered classifications (e.g., public, internal, confidential, restricted). Classification informs handling, access, and retention policies.

Category: Management

What controls are recommended for Sensitive Data?

Encryption, strong IAM, DLP, masking, monitoring, and secure disposal. Least privilege and segregation of duties reduce risk.

Category: BestPractice

How do regulations affect handling of Sensitive Data?

Regulations like GDPR, HIPAA, and PCI DSS impose strict processing, security, and breach notification requirements, with penalties for noncompliance.

Category: Regulation

Is all PII automatically Sensitive Data?

Often, yes, but sensitivity varies by context. For example, an email address may be less sensitive than biometric data, requiring proportionate controls.

Category: Misunderstanding

How should Sensitive Data be stored long term?

Apply encryption, retention limits, and archive tiers with access auditing. Use immutable backups and key management best practices.

Category: Requirements

What are common mistakes with Sensitive Data?

Over-collection, sharing beyond need-to-know, and storing unencrypted data in backups or logs lead to unnecessary risk and compliance issues.

Category: Mistakes

How do you discover Sensitive Data in large estates?

Use automated scanning, pattern matching, and ML-based classification integrated into catalogs. Validate results with data stewards.

Category: Testing

What is the relationship between Sensitive Data and risk assessments?

Sensitivity levels drive risk assessments, informing required controls and monitoring. Regular reassessments reflect changing threats and business use.

Category: Risk