Language is a funny thing. Depending on what you call fizzy drinks or how you refer to a group of people (y’all, youse, or you guys), linguists can triangulate exactly where you live in the United States.
Most of the time, these regional language differences are no big deal. But when differences in definition lead to different applications of the law, things get…tricky.
Take one of the most important terms in data privacy laws for example: “sensitive data.”
Sensitive data is a type of personal information requiring more protection than others. But here’s the problem: Not all personal information is considered sensitive, and different regulations define “sensitive data” differently.
This discrepancy can create huge headaches for businesses, not to mention serious compliance risks and liabilities if your data is not handled correctly within each jurisdiction.
So, what do businesses need to know about sensitive data, and how can they manage it to protect their customers and businesses?
What is sensitive data?
Sensitive data is a subset of personal information. Think of it in terms of dogs: Not all dogs are golden retrievers, but all golden retrievers are dogs. Similarly, not all personal information is sensitive data, but all sensitive data is personal information.
Data privacy laws generally protect individuals’ rights to control their personal data and regulate how businesses can collect, use, share, store, and sell that information. Sensitive data gets the protections of personal information, and more.
Several types of data may be deemed as sensitive data, but they vary from state to state, and even region to region.. Most U.S. data privacy laws include the following under the umbrella of sensitive data:
- Citizenship or immigration status.
- Personal data that indicates a person’s racial or ethnic origin.
- Religious or philosophical beliefs.
- Data that reveals your precise geo-location.
- Mental or physical health information and diagnoses.
- Data regarding a person’s sexual orientation.
- Genetic or biometric data (most often only when processed to identify an individual).
But that’s just looking at the U.S.! The European Union’s General Data Protection Regulation (GDPR) also factors in sensitive data referred to as “special categories of personal data,” which includes some elements that aren’t consistently addressed in U.S. privacy regulations, such as political opinions and trade union membership.
State variations in sensitive data
Let’s explore states’ definitions of sensitive data a bit further. Each state has its own peculiarities when it comes to sensitive data that businesses must consider.
Here are a few examples to illustrate this:
The California Consumer Privacy Act, which is often considered the most expansive state data privacy law, includes data points such as:
- Identifying data such as a person’s Social Security, driver’s license, state identification, or passport number.
- Any account login, password, or credentials allowing access to an account.
- Trade union membership.
- Contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication.
- Philosophical beliefs.
Further examples include Oregon, which includes data indicating a person’s national origin; Colorado, which includes neural data, and Connecticut, which includes status as a crime victim. Still other states focus more narrowly on issues for example, Washington’s My Health My Data Act (MHMDA) focuses on consumer health data, including information from health apps, fitness trackers, and other consumer health technologies. MHMDA designates this data as sensitive, but Washington’s not the only state with health data regulations—Nevada, Maryland, and Connecticut are also in the game here.
Sensitive data: opt-in vs. opt-out
Many states (but not all!) require opt-in consent for sensitive data. What does “many” mean, though? This quick breakdown is here to help.
- Opt-in states
- Colorado
- Connecticut
- Delaware
- Indiana
- Montana
- Oregon
- Tennessee
- Texas
- Virginia
- Opt-out states
- California
- Iowa
- Utah
Okay, but what does it mean if you require opt-in consent?
It means that consumers must take an action that gives a business permission to collect and process their information. Let’s say you’re signing up for a fitness tracking app as you train for a 10k. To give valid consent, a consumer might click an unchecked box next to a statement like, ‘I consent to the collection and processing of my health data for personalized fitness recommendations.’ (And ideally, the consent request will be accompanied by an explanation of how the health data will be used, stored, and protected).
Opt-out is considered less stringent than opt-in. In an opt-out scenario, a consumer would have to check (or uncheck) a box to request that the company not collect their information; i.e., the person’s action stops the business from collecting or using their information. So, if you’ve been operating in an opt-out state and are expanding your operations, you may have to make some significant process changes to stay compliant with newly applicable laws.
What about GDPR? Under this law, all processing of personal data requires a legal basis. For special categories of personal data (the GDPR equivalent of sensitive data) businesses must obtain explicit consent, which is an even higher bar than opt-in consent.
How can companies manage sensitive data and comply with such varying privacy laws?
Tracking the matrix of sensitive data elements can feel like a full-time job. So, how can businesses balance legal requirements with operational efficiency?
While the specific steps a business may take will vary depending on its needs, the general elements of success can be divided into the following categories.
Understanding your data
Tracking and managing your data processing with a data inventory is one of the best ways to set yourself up for success. If you understand your data, you are better equipped to manage it (and to get the most value out of it!).
Regular data inventory reports can help ensure that you classify your data correctly and that sensitive data undergoes the correct processing procedures. During this process, you can review how to identify this kind of information within your organization and who has access to it.
What does this entail? Beyond conducting a data inventory, you should:
- Ensure you have onboarding processes for new vendors, including details on what types of data they’ll have access to and their data protection measures.
- Regularly assess whether the current data collection aligns with business needs and legal requirements.
- Conduct privacy impact assessments (or data protection impact assessments under GDPR) for any new data processing activities or technologies being considered.
Implementing privacy by design principles
Privacy by design is a strategy that places privacy as a central structural requirement of your systems and operations rather than an afterthought.
The core principles of privacy by design include:
- Be proactive, not reactive.
- Make privacy the default setting.
- Embed privacy into the design.
- Provide full functionality regardless of privacy choices.
- Ensure end-to-end security.
- Maintain visibility and transparency.
- Respect user privacy.
Conduct privacy impact assessments
Privacy impact assessments (PIAs) are an important resource for businesses to flag the privacy risks of a process, product, service, or feature – and are required when processing sensitive data in many regions. Whenever data processing represents a high risk to individuals, such as when you start collecting new data (especially sensitive data), businesses should determine whether a PIA is required.
Still, regardless of whether they are required, PIAs can provide significant advantages through increased efficiency, compliance, documentation, and transparency with governmental and public bodies.
Take a close look at your data retention practices
Just because you have it doesn’t mean you need to keep it.
It’s easy for businesses to overlook their data retention and deletion practices. However, many privacy laws require that personal data be kept for no longer than necessary for the purposes for which it was collected. This concept is commonly referred to as data minimization.
To make sure you’re one of the businesses handling sensitive data responsibly, create clear data retention policies that:
- Specify how long different data types will be kept based on legal requirements and business needs.
- Detail how data will be securely deleted or anonymized when no longer needed.
- Outline the process for regular reviews of stored data to ensure compliance with retention policies.
- Describe procedures for handling data retention during legal holds or investigations.
These policies should be documented, communicated to all relevant staff, and regularly updated to reflect changes in laws or business practices.
2025 Privacy Checklist
Check out our Privacy Checklist for tips and practical guidance to establish a sustainable compliance program.
Translating privacy laws, one dialect at a time
As dialects vary from region to region, so do the definitions and applications of “sensitive data” in privacy laws across states.
Need a translator to navigate data privacy laws? Contact Red Clover Advisors to discuss how you can protect your data privacy and security.