What is Sensitive Data: How to Protect Important Personal Data

Sensitive personal data is among the most valuable information attached to us; it’s so valuable that there are international regulations for its maintenance, storage, and management. It is data that contains essential details about us, like Social Security Numbers (SSNs), bank accounts, tax IDs, health insurance data, and all the other “unique-to-one” credentials. These pieces of identifying information are essential for life in modernity, as they ensure individuals get their specific entitlements—this same power draws online threats to hunt them.

A threat actor might approach the theft of sensitive data in two ways. Sometimes, they target an organization, hoping to collect thousands of information records over a few hours. Other threats, however, might take a more personal approach—and goad consumers into sharing their details. The ever-increasing rate of cyber threats is a significant risk to consumers and organizations, and without robust security and proactive caution preventing the exposure of sensitive data, anyone could be a target for information misuse.

This content provides technology solutions, policy recommendations, and practical advice for individuals and organizations to best protect their data from the online threats we face every day.

What is Sensitive Data?

Sensitive data takes forms from personal identifying credentials to an organization’s trade secrets; consequently, judicial courts consider a wide variety of data sensitive, particularly across state lines and nations. In addition to these many varieties, there are also differing legal definitions, which can create confusion about what is and isn’t legally protected data under regulations like the General Data Protection Regulation (GDPR)

Generally speaking, sensitive personal data is any information that can cause undo harm, damage, or losses to the individuals and organizations it pertains to. Some judicial regions consider sensitive data as anything associated with a person, including their name - while others consider sensitive information confidential, like credit card numbers and social media.
Other types of sensitive information can include:

•  Protected health information like biometric data or medical records
•  Nonpublic personal data like employment or loan histories
• Private details like SSNs, driver’s license numbers, or income history

Why It’s Important to Protect Sensitive Data

Sensitive data is any information that an individual or organization wouldn’t want in the wrong hands; protecting sensitive data is essential because its exposure can cause reputational and financial fraud for victimized organizations and severely harm consumers.

For example, suppose a cybercriminal breaches a healthcare network—and accesses the medical information of thousands of patients within the system. The malicious agent could then use that data to further other schemes or to obtain entitlements by impersonating the owner of that information. In the case of medical fraud, this could mean a criminal’s medical data being added to authentic information, putting the owner of the stolen data at risk for physical harm (especially if opposing allergies and drug doses are erroneously added to the same record).

There are countless examples of the consequences of sensitive information exposure, all helping to emphasize the importance of protecting it. Individuals must do all they can to protect their sensitive data (more on that below). At the same time, corporations must make big moves to protect consumer confidentiality, including complying with legal and regulatory requirements and preventing single-point failures like data breaches.

Types of Sensitive Data 

As mentioned above, there are many varieties of sensitive data, some of which pertain to specific individuals and others that concern organizations and their interests. Due to so many different classifications, each type of data has specific needs and unique protections; without unique protections, it becomes more likely that a malicious actor can access and steal the information. The most critical data elements for the individual are personally identifiable information (PII), financial data and credentials, and protected health information (PHI).

Personal Identifiable Information (PII)

In cybersecurity, PII is among the most highly sensitive personal data; this category of information includes all data that someone can use to identify an individual. Consequently, this same data can be misused in identity theft, fraud, impersonation, and many other cyber crimes and criminal schemes. Most commonly, PII is associated with data like:

• Government-issued IDs like SSNs, driver’s licenses, or passport credentials
• Digital identifiers like IP addresses, cookie IDs, or device signatures
• Personal associations like names, telephone numbers, and email addresses

Consumers are unlikely to reveal this information to strangers, but that doesn’t mean an online threat couldn’t discover it another way. Organizations worldwide collect this data and other private information—and if they aren’t prepared to battle in the cyber wars, they might end up with irreparable damages caused by data breaches, malware, or another type of cyber assault.

Financial Information

Another highly confidential data is financial information. The exposure of any financial data is a critical privacy failure, as cybercriminals only need a few elements to cause significant issues for their victims, like account, bank, mortgage, or loan fraud. Any aspect of a consumer’s (or organization’s) financials is considered sensitive data, including:

• Payment details like credit and debit card numbers
• Account information like routing numbers, loan IDs, and income history
• Provider statements like quarterly account histories or firm offers

Apart from the risks created by organizations maintaining this data (i.e., becoming a bigger target for data breaches and security incidents), consumers also have significant risks when they share this data. From relying on auto-filling browsers to physical trash, a consumer might be putting their financial data at risk for misuse if they do not prioritize confidentiality over convenience.

Protected Health Information (PHI)

The last information category this content will feature is PHI; this data contains elements of a consumer’s (or organization member’s) medical history, which could impact a person’s private and professional life if exposed or misused by a criminal - as demonstrated above. PHI information takes many forms, including:

• Personal conditions like physical or mental health statuses
• Health insurance data like provider names, insurance policy IDs, or medical bills
• Medical histories like patient records, diagnoses, and treatments

Consumers are unlikely to share these personal details with others, but that doesn’t mean the information is completely safe. Like financial information, a threat actor could sift through an individual’s trash to locate physical proof of their health data, or the malicious agent could manipulate their victim into sharing seemingly harmless details (i.e., appointment times, symptoms, or past prescription drug use).

Organizations that house medical information must comply with specific regulations or face legal inquiries. In the US, the most critical of these protections is the Health Insurance Portability and Accountability Act (HIPAA), which considers all medical information, health statuses, and payment details of health treatments among the most vital sensitive data associated with someone.

Personal Data vs. Sensitive Data 

We’ve described personal and sensitive data as equivalent (if not slightly conflated). However, there are distinct differences between them, which naturally correlate to the necessary protection strategies of each. For example, personal data includes all identifiers associated with a consumer, while sensitive data includes everything associated with a person.

The best way to describe the differences between personal and sensitive data is to attribute all consumer data as sensitive, with some being “non-sensitive” or personal. Consider these examples:

• Social security numbers and federal taxpayer IDs are sensitive PII (always).
• Social media profile names and phone numbers are non-sensitive PII (most of the time).

Moreover, those data elements considered non-sensitive are commonly available for data brokers to sell and share - as they can be considered public information. In comparison, no sensitive data is purchasable by consumers, although some organizations may share the data according to data privacy and maintenance laws, such as the General Data Protection Regulation (GDPR).

Drawing a distinct line between personal and sensitive data is essential to creating proper data protection policies and strategies. No organization will have a foolproof continuity plan for a significant data breach, but they can influence how much personal (and sensitive) data a threat actor might access.

How To Protect Your Sensitive Data

No matter how careful we are about concealing our sensitive data, threats will always seek access. Individuals and organizations must employ multiple security strategies to protect and guard that data from misuse. Among the most important of these strategies are complex passwords, multi-factor authentications, encryptions, data backups, and VPNs; consumers and organizations can use these tools to provide a base level of prevention security. However, adding more could be the difference between sensitive data staying confidential and that same data being in the hands of a criminal.

Use Strong, Unique Passwords

Every cybersecurity expert has touted the necessity of strong passwords; the same is true today, as criminals launch more attacks on organizations than ever. The stronger and more complex a password is, the harder it is for criminals (and their technology) to guess - and that’s a significant part of other schemes they might be planning.

For example, suppose someone uses the same credentials to log into different platforms once a threat actor learns of one account. In that case, they can easily discern other instances of the same credentials online. These types of attacks are also called credential-stuffing incidents, and they are responsible for the loss of thousands of accounts every year in ATO Fraud .

Password managers are among the best solutions to avoid password fatigue and the risks associated with simple passwords; however, users don’t need a manager to create strong, complex passwords for themselves. They only need to consider a mix of written characters, including uppercase and lowercase letters, numbers, and symbols (if applicable):

•  Weak passwords: 123456, Admin, FirstNameLastName, PetName, Birthday
• Strong passwords: 1!!FmuQGfRI1^CAx&&Ye, onOs#Vuul687^qvbT^O0

Enable Two-Factor Authentication (2FA)

If a strong password is the most basic level of security for a user account, two-factor authentication is the next step. 2FAs send an authenticator code to a device or account the owner controls. Users can verify their identity by submitting that one-time token to the requesting software while keeping threats from their profiles.

There are many different types of authenticators, depending on what the platform uses for security. 2FAs are commonly used in the settings of platforms and applications or the profile alteration settings of specific software, like dating apps. These authenticators typically use one of these methods to confirm an identity:

•  A text or SMS of a one-time token code to an associated phone number
•  An email with a limited-time code sent to an associated address
• Third-party authenticator apps with digital identifiers already established

Secure Your Home and Mobile Networks

Strong passwords and 2FAs are great for securing personal accounts, but other dangers are lurking beyond accessible profiles. Home wi-fi networks are a common target for sleazy, small-time criminals - but they are a target nonetheless. Consumers can secure their home wi-fi by making some small but impactful changes to their network connections:

• Change your router’s default password, making it challenging for strangers to connect to and steal resources from.
• Enable WPA3 encryptions, which implement end-to-end encryption. That way, even if someone gets on your home network, they can’t see what you’re up to.
• On mobile devices, enable biometric locks like fingerprint and face ID scanners; these can help deter threats, as they’ll be wasting time without your signatures.

Backup Your Data

Another security defense to consider is data backups. For the consumer, a data backup can be necessary, particularly when they work from a personal computer. If anything happens to the device, they’ll have a safe copy of all their work history elsewhere. For the organization, however, data backups are an essential element of internet security; consider, for example, the constant threat of ransomware online. If an organization falls victim to encryption ransomware, it can avoid paying ransom fines by relying on the older, saved data.

How to best backup your data (or your organization’s data) depends on the threats you face and the level of security you want to implement. Some organizations are comfortable moving all their files to the cloud, which can promote faster, safer work environments. However, the cloud isn’t the only option; other organizations have found better security by moving their data into physical, segmented databases with physical guards to maintain continued security. When it comes down to it, there are many ways a person or organization can protect their data—the only thing that matters is that the information is there when you need it.

Use A VPN On Public Wi-Fi

Using public wi-fi has its benefits—but it has greater risks. An unsecured connection can be a significant target for small-time threat actors, particularly those scouring data packets for interesting data. For example, suppose a business person is connected to a public free Wi-Fi channel at a coffee shop. They could work, look at their bank accounts, and check their emails. However, they’d never be able to tell who was also watching their behaviors. Much like hiding in bushes on the side of the road, a malicious actor could be watching at any time—at least on a public connection.

Relying on public wi-fi is never a long-term solution, even when your favorite coffee shop hosts it. Virtual private networks (VPNs) create a private, encrypted connection to the Internet, which is often even stronger security-wise than single-password hotspots and home networks.

Sensitive data comes in many forms, from individual names and SSNs to an organization’s trade secrets and account data. It is highly valuable information, making it a high-risk target for online threat actors. However, by implementing some basic cybersecurity measures, consumers and organizations can mitigate the potential issues caused by those threats. Strong, unique passwords, multi-factor authentications, network encryptions, data backups, and VPNs are some of the best primary defenses everyone should employ to browse the Internet safely.

The Internet’s landscape changes daily, and what used to be safe—can quickly become obsolete. Stay informed and up to date with defensive technology and cybersecurity insights to protect your sensitive data, as well as the digital environment of your favorite organizations.