Personal data is any information relating to an identified or identifiable natural person (data subject).
Data that reveals data subjects’ racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data (when used to identify a data subject), data concerning health, and data concerning a data subject’s sex life or sexual orientation are all sensitive data – or ‘special categories of personal data’ under the GDPR – and must not be processed except in certain circumstances.
