What Is Sensitive Data? Types and Examples

In cyber security, sensitive data is information that must be protected because its exposure, alteration or loss could harm a person or organization. Security teams apply handling rules, restricted access and monitoring wherever this information is stored, used or shared.

Sensitive data is any information that an organization must protect because unauthorized access, disclosure, alteration or loss could create meaningful harm. It includes regulated records, such as payment card, passport and bank account numbers, as well as business-specific information, such as source code, product designs and strategic plans.

Information security programs protect the confidentiality, integrity and availability of this data. In practice, that means knowing where sensitive information resides and who or what can access it. Teams also need to track how it moves through email, endpoints, cloud applications, SaaS platforms and AI tools, and respond when it moves somewhere it should not.

Sensitivity depends on context. A public job title may be non-sensitive by itself. When it is combined with compensation or health information, the resulting record may require stricter classification and protection.

Identifying sensitive data, often called sensitive data discovery, means locating information, confirming what it is and recording who can reach it. Most organizations follow five recurring steps:

1. Discover repositories. Scan SaaS applications, cloud infrastructure, on-premises file shares, databases and endpoints. Include backups, abandoned stores and shadow repositories.

2. Classify the data. Use regulated categories, including payment card, passport, bank account and government-issued identification numbers. Add business-specific categories for source code, product designs and strategic plans.

3. Map access. Identify the people, groups, applications, service accounts and AI agents that can reach each store. Record where sharing is public, external or broader than necessary.

4. Prioritize by impact. Start remediation with the information whose exposure would cause the most harm instead of working only in the order items were discovered.

5. Review regularly. Refresh the inventory on a schedule. Data is copied, exported and re-shared continuously, so a one-time discovery exercise becomes outdated quickly.

Organizations define categories that reflect applicable requirements, business needs and the harm that misuse could cause. Common types of sensitive data include:

• Personal and identity data. Government-issued identification numbers, passport numbers, contact details and other records that identify or relate to a person.
• Financial data. Payment card numbers, bank account details, transaction records and other information connected to financial activity.
• Health data. Medical histories, diagnoses, treatment details and other health-related information.
• Credentials and security data. Passwords, access tokens, private keys and authentication information that could be used to reach systems or accounts.
• Confidential business information. Source code, product designs, strategic plans, intellectual property and other information an organization treats as confidential.

These categories can overlap. The same record may contain personal, financial and health information, and it may require more restrictive handling as a result. Classification labels also vary by organization. A practical model may distinguish public, internal, confidential and restricted data, but the final levels and handling rules should match organizational policy and applicable requirements.

Non-sensitive data is information that is expected to cause little or no harm if it is disclosed. Examples may include published marketing material, public filings or an organization's main address. Sensitive data, by contrast, has a meaningful exposure or misuse impact and requires specific handling and protection.

The distinction is not permanent. Non-sensitive fields can become sensitive when they are aggregated or repurposed. For example, a name, job title and office location may be public, but the same fields joined with compensation or health information create a more sensitive record. Organizations should reassess classification when data is combined or used in a new context.

Knowing where sensitive data resides and who can access it helps organizations make better decisions about handling, sharing and monitoring. Discovery makes stored and shared information visible across cloud, SaaS, databases, endpoints and files. Data classification helps teams apply controls that reflect business context, while impact-based prioritization focuses action on the most consequential exposure scenarios.

Sensitive data protection should follow the information across the places where people and systems store, use and share it. A practical program combines clear policy with technical controls and ongoing review.

• Define handling rules. Connect each classification level to requirements for storage, sharing, retention and disposal.

• Limit access. Grant access based on role and business need, and review permissions as responsibilities change.

• Monitor data movement. Use data loss prevention and related controls to identify risky transfers across email, endpoints, cloud and collaboration tools.

• Review cloud and SaaS sharing. Audit default settings and public links. Remove unneeded domain-wide or external access, and govern third-party applications and OAuth grants.

• Set controls for AI use. Approve specific AI tools and use cases, apply data security for AI controls, inspect prompts, uploads and responses where appropriate, and monitor unapproved AI use.

• Reassess as data changes. Update classifications and controls when information is combined, copied to a new system or used for a new purpose.