Data Protection Act, 2023, sensitive data and data of minors
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 22 December 2023.
A sensitive categories rule binding public and private bodies.
As of 6 September 2026.
What it requires
- Do not process race, ethnic origin, biometric, genetic, political, religious or health-related personal data unless a specific exception in section 22 applies.
- Obtain consent from a parent or legal guardian before processing the personal data of a person below 18 years, and verify that such consent has been given.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Processing of personal data relating to race, ethnic origin, biometrics, genetics, political opinions, religious or philosophical beliefs, or for identifying a person's health or sex life, is prohibited unless a specific exception applies, such as the data subject's explicit consent, protection of vital interests, or the data being manifestly made public by the data subject.
No person may process a child's personal data (a person below 18 years) without consent from the child's parent or legal guardian.
When LexLint raises it
processes_biometricsprocesses_voiceserves_minors