8 Common Types of Sensitive Data With Examples

Eight common types of sensitive data are personally identifiable information (PII), health and medical data, financial and payment data, authentication and credential data, biometric data, intellectual property, confidential business information, and security and infrastructure data. The distinction between them depends on what the information primarily represents, relates to, or enables.

Sensitive-data classifications vary across legal, regulatory, and organizational contexts.

What Is Sensitive Data?

Sensitive data is information whose exposure, misuse, alteration, or loss creates a material risk of harm. Payroll exports expose identities and bank details. A valid API key authenticates requests according to its assigned privileges, while leaked source code discloses implementation details.

File type alone does not determine sensitivity. Personal and health records reveal facts about people. Payment credentials authorize financial actions, whereas authentication secrets establish trusted identities or requests. Proprietary material carries a different consequence because disclosure transfers knowledge the organization depends on keeping private.

Personal Data vs. Sensitive Data

Personal data relates to an identified or identifiable person. Sensitive data uses a broader test: the consequence of exposure or misuse.

A public contact email carries little sensitivity on its own. Connect the same address to payroll, medical history, or authentication details and the security impact changes. Credentials, pricing models, proprietary code, and trade secrets need no personal identifier to warrant strict handling.

What Are the Common Types of Sensitive Data, With Examples?

A passport number, password, source code, and network diagram are all sensitive for different reasons.

1. Personally Identifiable Information (PII)

A passport number is sensitive because it points to a specific person, which is the relationship at the center of personally identifiable information (PII). National identification numbers and driver’s license numbers work in a similar way. Names, dates of birth, home addresses, personal email addresses, telephone numbers, and employee identifiers also identify or help identify an individual.

That combination of identifiers and contact details appeared in the Miljödata incident described by Sweden’s Authority for Privacy Protection (IMY). In its September 22, 2026 report, IMY stated that, according to Miljödata, 2.2 million people were affected by the company’s August 2025 breach. Stolen data included personal identity numbers and contact details. The compromised material was subsequently published on the darknet.

Identity, however, is not always the most specific relationship contained in a person-related record.

2. Health and Medical Data

A diagnosis, prescription, or test result carries clinical meaning beyond the identity of the patient. Health and medical data covers information about health status, healthcare, treatment, or medical history. Laboratory results and medical imaging document findings, while prescriptions and treatment histories record aspects of care over time. Patient identifiers, health-insurance information, and genetic information may also belong here, depending on context.

The U.S. Department of Health and Human Services Office for Civil Rights reported on September 17, 2026, that a January 2020 phishing attack compromised an Ambry Genetics employee email account. Protected health information belonging to 225,370 individuals was potentially exfiltrated. The affected data included diagnoses, laboratory results, medications, and treatment details.

3. Financial and Payment Data

Clinical records center on care; bank, payment, and transaction records capture a different relationship involving money and financial activity. Financial and payment data includes information tied to accounts, payments, transactions, taxation, or financial position.

Typical examples include:

• bank account numbers and credit- or debit-card details;
• payment information and transaction histories;
• tax records, payroll information, and loan information; and
• non-public financial statements.

The New York Attorney General reported on September 24, 2026 that unauthorized access to American Medical Collection Agency systems occurred from August 1, 2018 to March 30, 2019. The incident potentially exposed information belonging to 10.2 million Labcorp patients nationwide. For approximately 420,000 affected New Yorkers, exposed data included payment-card information, Social Security numbers, and medical-test information.

The 10.2 million figure covers patients whose information was potentially exposed overall. It does not mean payment-card information belonging to 10.2 million patients was exposed.

A bank account number identifies the financial account involved. A password serves another purpose because it helps authenticate the user.

4. Authentication and Credential Data

That authentication role is central to credential data. Passwords and PINs help verify a user. API keys and service-account credentials authenticate applications or services. Access tokens, authentication tokens, session tokens, MFA recovery codes, private cryptographic keys, and security answers support other forms of authentication or authorization.

South Korea’s Personal Information Protection Commission reported on June 11, 2026 that a former Coupang employee obtained authentication signing keys and forged authentication tokens. The employee then used them to reach company systems. The resulting breach leaked data relating to approximately 33.22 million Coupang users during activity spanning April to November 2025.

The 33.22 million figure measures affected users, not the number of passwords, signing keys, or tokens compromised. An exposed credential establishes exposure, but it does not by itself prove successful account compromise.

Authentication does not always depend on something a person knows or holds.

5. Biometric Data

Recognition also draws on characteristics of the person. Biometric data uses physical, physiological, or behavioral characteristics for recognition, identification, or verification.

Fingerprints, facial templates, iris scans, retina scans, and palm prints represent physical or physiological traits. Voiceprints, gait patterns, and behavioral biometric patterns apply biometric recognition to voice or behavior.

The processing context determines whether such a characteristic qualifies as biometric data. A photograph, recording, or physical feature does not automatically fall into this type merely because it captures something about a person. The relevant factor is whether the characteristic is processed for biometric recognition, identification, or verification.

6. Intellectual Property

Sensitive information is not limited to people, accounts, or authentication. Source code, product designs, formulas, and unpublished inventions are sensitive because they embody proprietary knowledge or technical creation. In this context, they are examples of intellectual property.

Proprietary algorithms and engineering specifications add technical detail to that group. Research and development data, technical documentation, proprietary datasets, and trade secrets extend it to other forms of protected knowledge and creation.

Trial evidence summarized by the U.S. Department of Justice on January 29, 2026 concerned former Google engineer Linwei Ding. According to the DOJ, Ding stole more than 2,000 pages of confidential information containing Google’s AI trade secrets and uploaded the material to his personal cloud account. The conduct described occurred approximately between May 2022 and April 2023. The DOJ figure refers to pages, not files.

Not every sensitive business record is a proprietary creation.

7. Confidential Business Information

Organizations also hold non-public information about internal processes, decisions, strategy, and commercial relationships. That material falls under confidential business information.

Business plans and strategic plans reveal organizational direction. Pricing strategies and sales forecasts concern commercial decisions, while customer lists, supplier information, and contracts relate to business relationships. Internal financial reports, merger and acquisition information, internal communications, and non-public product roadmaps reflect planning, internal decisions, or commercial activity.

A federal court opinion dated August 24, 2026 recorded that departing Bankers Life agent Christian McDaniel downloaded 955 policyholder records on March 1, 2021, the day he resigned.

The infrastructure supporting those activities contains sensitive details of its own.

8. Security and Infrastructure Data

That technical environment reveals more than the records it stores. Security and infrastructure data covers non-public information about architecture, connections, configurations, and assessments.

Network, system, and cloud architecture diagrams show component arrangement and connections. Firewall configurations, deployment configurations, and internal addressing information capture configuration choices and internal structure. Asset inventories identify resources within the environment, while vulnerability assessments and security-testing results document findings about its security state.

These artifacts concern the technical environment itself, not authentication. An administrator password belongs with credential data because it is used for authentication. A diagram showing privileged systems instead exposes their structure without functioning as a credential.

How CloudSEK Helps Identify Exposed Sensitive Data

Some sensitive information can surface outside an organization through credential leaks, data leaks, exposed code, or internet-facing assets. Once that happens, the challenge shifts from classifying the information to identifying where it has appeared and what security relevance it may carry.

CloudSEK’s XVigil monitors surface, deep, and dark web sources for organization-specific signals such as leaked credentials, data leaks, and exposed code. By connecting those signals to the affected organization, security teams can see which externally visible information may contribute to an initial access path without treating its presence alone as proof of compromise.

BeVigil extends that visibility to the external attack surface. It discovers internet-facing assets and identifies issues such as credentials exposed in code, misconfigurations, and other externally observable weaknesses.

Frequently Asked Questions About Sensitive Data

Is sensitive data the same as personal data?

Not necessarily. Personal data concerns information linked to identifiable people, while sensitive data can be broader in an enterprise context. It may also include credentials, proprietary business material, intellectual property, and security or infrastructure information that does not identify an individual.

The exact distinction depends on the legal, regulatory, or organizational framework being applied, so the two terms should not be treated as universally interchangeable.

Can the same information belong to more than one sensitive data category?

Yes. The categories are useful for classification, but they are not mutually exclusive.

Overlap appears in several forms: a health record that contains PII, a biometric identifier that also qualifies as personal information, or a technical document combining intellectual property with security or infrastructure details. The relevant classification depends on the relationships present in the material, not on forcing every record into a single bucket.

What Is the Difference Between Sensitive Data and Confidential Data?

“Confidential” commonly refers to an access or handling designation, while “sensitive data” describes information that warrants protection because unauthorized disclosure or use could have adverse consequences.

The terms can overlap without being equivalent. An organization may label records confidential under its handling rules, whereas sensitive material may be classified for reasons tied to its content or function. A universal legal distinction should not be assumed without a specific framework or jurisdiction.

Can Business Information Be Sensitive Even If It Contains No Personal Data?

Yes. Sensitive enterprise information does not need to identify a person.

Examples include proprietary source code, pricing strategies, strategic plans, non-public product roadmaps, and security architecture. Their sensitivity comes from the business, technical, or proprietary value they carry, not from a connection to personal identity.