Under the GDPR, special categories of data are the most sensitive kinds of personal data, including information about health, biometric data, genetic data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and sex life or sexual orientation. They are treated more strictly because misuse can cause serious harm, discrimination, or exposure of intimate details.
In cyber security, these data types matter because they are high-value targets for criminals and require stronger protection controls. A breach involving health records or biometric identifiers can have long-lasting consequences, so defenders should use data minimization, strict access control, encryption, logging, short retention periods, and careful vendor management. Attackers often seek them in phishing, ransomware, or database theft because they are easier to extort or sell than ordinary records. For organizations, handling special categories of data usually demands a clear legal basis, a risk assessment, and security measures that go beyond standard privacy controls.