Data Protection Act, 2013, sensitive personal data

Data Protection Act, 2013, s. 18 (sensitive personal data)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not process sensitive personal data, meaning information about a data subject's physical or mental health, sexual orientation, political opinions, religious or similar beliefs, or the commission or alleged commission of an offence, unless the data subject has given explicit consent to the processing.
Where consent is not obtained, process sensitive personal data only on a listed ground such as an employment law obligation, protecting the vital interests of the data subject or another person, medical treatment by a healthcare professional, legal proceedings or advice, the administration of justice, or exercising a function conferred by law.
You may also process sensitive personal data that the data subject has already made public through their own deliberate action.

What it reaches

Obligation class

Prohibition, Consent

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 18(1) bars a data user from processing sensitive personal data, meaning information about a data subject's physical or mental health or condition, sexual orientation, political opinions, religious or similar beliefs, or the commission or alleged commission of an offence, except where the data subject has given explicit consent to the processing.

Section 18(1)(b) lists the alternative grounds on which sensitive personal data may be processed without consent, including exercising or performing an employment law right or obligation, protecting the vital interests of the data subject or another person where consent cannot be given or reasonably obtained, medical treatment by a healthcare professional or a person under an equivalent duty of confidentiality, legal proceedings or obtaining legal advice, establishing, exercising or defending legal rights, the administration of justice, or exercising a function conferred by written law.

Section 18(1)(c) also permits processing sensitive personal data that the data subject has already made public through their own deliberate action. Section 18(2) lets the Minister, by Order published in the Gazette, exclude some of those grounds in specified cases or make them subject to further conditions.

When LexLint raises it

crawls_web
trains_models
handles_health_records

Read the law

Official Gazette text of the Data Protection Act, 2013, Government Printing Office, Antigua and Barbuda

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app