{"id":41015,"date":"2026-09-14T10:00:00","date_gmt":"2026-09-14T10:00:00","guid":{"rendered":"https:\/\/grapenordic.com\/?p=41015"},"modified":"2026-11-11T09:25:29","modified_gmt":"2026-11-11T09:25:29","slug":"ordinary-and-sensitive-personal-data","status":"publish","type":"post","link":"https:\/\/grapenordic.com\/en\/ordinary-and-sensitive-personal-data\/","title":{"rendered":"The difference between ordinary and sensitive personal data in everyday work"},"content":{"rendered":"\n

Sensitive personal data is a closed list in GDPR Article 9. It covers information about racial and ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify a person, health, and sex life or sexual orientation. Everything else is, in the legal sense, ordinary personal data.<\/p>\n\n\n\n

That surprises many people, because the list fits poorly with what people themselves regard as private. Salary is not on it. Neither is the national ID number. Both still need special protection, which is why Danish practice works with more than two categories.<\/p>\n\n\n\n

The categories in practice<\/h2>\n\n\n\n
Category<\/th>What belongs here<\/th>Rules<\/th><\/tr><\/thead>
Ordinary personal data<\/td>Name, address, phone number, email, job title, date of birth, photo, customer number<\/td>GDPR Article 6<\/td><\/tr>
Confidential information<\/td>National ID (CPR) number, salary, finances and debt, family matters, employment matters such as warnings and dismissals<\/td>Ordinary data that requires extra protection. CPR numbers have their own rules in section 11 of the Danish Data Protection Act<\/td><\/tr>
Sensitive personal data<\/td>The special categories listed in Article 9<\/td>Prohibited as a starting point. Requires an exception in Article 9 on top of the basis in Article 6<\/td><\/tr>
Criminal offences<\/td>Convictions, charges, criminal records<\/td>GDPR Article 10 and section 8 of the Danish Data Protection Act<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The Danish Data Protection Agency goes through the categories under Basic concepts<\/a> (in Danish), and the legal text is in the General Data Protection Regulation<\/a>.<\/p>\n\n\n\n

The everyday Danish word “personf\u00f8lsom” does not appear in the law. It usually covers a mix of confidential and sensitive information. That is fine as everyday language, as long as employees know that the two groups have different rules.<\/p>\n\n\n\n

Ordinary personal data is still protected<\/h2>\n\n\n\n

Calling the data “ordinary” can give the impression that the information is freely available. It is not. A customer’s email address may only be used for the purpose it was collected for, it has to be deleted when the purpose has been fulfilled, and a list of 4,000 email addresses sent to the wrong recipient is a personal data breach.<\/p>\n\n\n\n

The difference lies in how much it takes to process the data lawfully, and how strongly it has to be protected.<\/p>\n\n\n\n

Where does the national ID number belong?<\/h2>\n\n\n\n

No piece of information raises more questions than the CPR number. Under the GDPR it is ordinary personal data. In Denmark it has its own rules and is regarded as confidential.<\/p>\n\n\n\n

Private companies may only process CPR numbers when it follows from legislation, when the person has consented, or when one of the other conditions in the Danish Data Protection Act is met. An employer needs it to report salaries to the tax authorities, so the basis is in place. A webshop asking for a CPR number to create a customer profile rarely has one.<\/p>\n\n\n\n

For employees, three rules are enough:<\/p>\n\n\n\n