Special-category data is a GDPR term for highly sensitive personal data, such as health information, biometric data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, and data about sex life or sexual orientation. This class receives stronger protection because misuse can cause serious harm, including discrimination, identity abuse, or privacy exposure. In most cases, processing it requires an especially strong legal basis and extra safeguards.
In cyber security, special-category data matters because attackers often target it for extortion, profiling, or fraud, while defenders must protect it with tighter access control, encryption, logging, and strict retention rules. It also changes incident handling: a leaked medical record or biometric template is not treated like an ordinary customer file. Security teams should classify these records early, limit who can view them, and verify that every transfer, backup, or analytics use still matches the original lawful purpose.