Some data is classed as sensitive data by GDPR, these are:
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic data
- Biometric data for the purpose of uniquely identifying a natural person
- Data concerning health or a natural person’s sex life and/or sexual orientation
You cannot process the above, sensitive data unless you have certain conditions in place such as explicit consent from the data subject where they have signed a explicit consent statement.
Alternatively if you are collecting this data to fulfil your duty of care you can collect sensitive data.