Sensitive personal data refers to specific categories warranting heightened protection under GDPR Article 9 due to the elevated risk their misuse poses to individuals. Processing these categories is prohibited by default unless one of ten narrow exceptions applies — explicit consent being one. The Article 9 special categories include racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data used for identification, health data, and data about sex life or sexual orientation. For website operators, this most commonly arises through health-related forms, political sites, or behavioral profiling that infers protected characteristics. Standard GDPR consent is insufficient — explicit consent is required.