Sensitive personal data under the LGPD and in the clinic
Quick facts
- Definition
- Personal data about racial or ethnic origin, religious belief, health, sex life, genetic or biometric data, among others (LGPD, art. 5, II).
- In the clinic
- The patient record, medical history, and clinical photos contain health data and may contain biometric data.
- Rule
- Processing only under the grounds in art. 11 of the LGPD, with heightened care.
- Risk
- A leak has a serious impact on the patient and on the clinic.
Sensitive personal data is the category of personal information that the LGPD (Brazil's personal data protection law) treats most strictly, because its misuse can lead to discrimination or serious harm to the data subject. Article 5, item II, lists, among others: racial or ethnic origin, religious belief, political opinion, data concerning health or sex life, genetic data, and biometric data, when linked to a natural person.
Why does it matter in a facial harmonization clinic?
Clinic routines generate sensitive data at almost every stage:
- medical history with diseases, allergies, and medications;
- patient record with progress notes and procedures;
- clinical photos of the face;
- consent forms and quotes that reveal the treatment.
Processing is only allowed under the grounds set out in the law, such as protection of health in a procedure performed by a health professional, the data subject's specific and highlighted consent, or compliance with a legal obligation. See also LGPD legal basis.
How does it differ from ordinary personal data?
| Personal data | Sensitive personal data |
|---|---|
| Name, CPF (Brazilian tax ID), phone, email | Health, biometrics, racial origin, religion |
| More legal bases available | A narrower list of grounds |
| Generally lower impact | Greater potential impact, risk of discrimination |
What should you do day to day?
Frequently asked questions
What is sensitive personal data?
It is data that, if misused, can lead to discrimination or greater harm to the data subject, such as health information, racial origin, religious belief, or biometric data. The LGPD lists these categories.
Is a patient record sensitive data?
Yes. It contains health data, which the LGPD classifies as sensitive. That is why it requires restricted access, secure storage, and use consistent with the purpose of care.