A marketing lead insists that under the GDPR, 'sensitive data' always means passwords and other secrets. Which correction best reflects EU data protection terminology?
Select an answer to reveal the explanation.
Short Explanation
Secret is not the same as special-category. GDPR’s Article 9 list is about particular traits—health, biometrics for ID, politics, and similar—not about anything you keep in a locked drawer. Passwords matter for security, but they are not that list.
Full Explanation
Special-category data under Article 9 refers to specific sensitive traits such as health, biometrics used for unique identification, or political opinions—not secrecy alone. Marketing leads who equate GDPR “sensitive data” with passwords and other secrets confuse confidentiality/security concerns with the Regulation’s special-category taxonomy. Sensitive data under the GDPR does not mean any spreadsheet field marked confidential. Passwords are not the only Article 9 special category. Special categories do not cover every piece of personal data a company prefers not to publish. Exam caveat: “sensitive” in GDPR exam language usually points to Article 9 lists, not mere secrecy. Operational check: train civic staff with two columns—“Article 9 special category?” versus “confidential/security classification?”—so password vaults and health fields are governed under the correct frameworks. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan. Revisit the conclusion when facts, recipients, or processing purposes change, and record who approved the updated analysis.