Sensitive data

Sensitive data is information whose exposure, misuse, inference, or alteration could create substantial harm or requires heightened protection.

Plan for this page

Understand one concept in plain language and connect it to nearby ideas.

You will leave with: Depending on context and law, it may include health, biometric, financial, location, identity, protected traits, credentials, intimate content, children’s data, confidential business records, or safety information. Sensitivity also depends on combination and consequence.
Time: 3–8 min
Before you begin: No prerequisite. Keep one real example in mind.
Do this now: Read the explanation, then compare the example with the common misunderstanding.

Prepared next stepSet a sensitive-data boundary

Sensitive dataSensitive data is information whose exposure, misuse, inference, or alteration could create substantial harm or requires heightened protection.

Privacy
Personal data
High-risk use

Plain explanation

Depending on context and law, it may include health, biometric, financial, location, identity, protected traits, credentials, intimate content, children’s data, confidential business records, or safety information. Sensitivity also depends on combination and consequence.

Example

A résumé may become sensitive when combined with disability details, identity documents, salary history, and a private hiring assessment.

Why it matters

General-purpose AI services may retain, transmit, or expose context through providers and integrations. Use approved systems and the minimum necessary information, with qualified guidance for consequential cases.

Common misunderstanding

Misconception: a fact is sensitive only if it is embarrassing. Correction: sensitivity includes financial, legal, safety, discrimination, identity, confidentiality, and control harms.

Related concepts

Follow relationships, not only the alphabet

PrivacyPrivacy concerns appropriate control, expectations, and risk around how information about people is collected, inferred, used, shared, retained, and deleted.Personal dataPersonal data is information that relates to an identified or reasonably identifiable person, directly or through combination and inference.High-risk useA high-risk use is an application where failure, misuse, or unequal performance can create serious consequences for people, rights, safety, livelihood, or essential services.

Set a sensitive-data boundary

Sources and scope

What supports this object

NIST Privacy FrameworkU.S. National Institute of Standards and Technology

Supports contextual privacy-risk assessment and data minimization; categories receiving special legal protection vary by jurisdiction and sector.

Open source

Loading page content...

…