Data Protection Act, 2011, sensitive personal information

Act 13 of 2011, ss. 6(h), 40 and 76 (sensitive personal information)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 6 January 2012.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Section 6(h)'s general principle already binds everyone who handles, stores or processes personal information: do not process sensitive personal information (racial or ethnic origin, political affiliation or trade union membership, religious belief, physical or mental health, sexual orientation, or criminal or financial record) unless a written law otherwise provides for it.
Once Part III is in force, a public body may process sensitive personal information only with the person's consent, or where a listed exception applies, such as health care treatment by a health care professional, information the person already made public, research under section 43, law enforcement or national security, or determining access to social services.
Once Part IV is in force, a corporation may process sensitive personal information in its possession only with the person's consent, or where a listed exception applies, such as health care treatment, information already made public, research under section 43, or where written law requires it.

What it reaches

Obligation class

Prohibition, Consent

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 6(h) of the General Privacy Principles states that sensitive personal information is protected from processing except where otherwise provided for by written law, and this principle binds every person who handles, stores or processes personal information regardless of whether Part III or Part IV has been proclaimed.

Sensitive personal information is defined as information on a person's racial or ethnic origins, political affiliations or trade union membership, religious or similar beliefs, physical or mental health or condition, sexual orientation or sexual life, or criminal or financial record.

Section 40 would limit a public body's processing of sensitive personal information to cases where it has the person's consent, or the information is processed by a health care professional for preventive medicine, diagnosis, treatment or hospital care management, has already been made public by the person, is processed for research under section 43, serves law enforcement or national security, determines access to social services, or another written law authorises it.

Section 76 states the equivalent limitation for a corporation, in materially the same terms as section 40 except that it does not include a law-enforcement-or-national-security ground.

Neither section 40 nor section 76 is shown as commenced: both sit in Part III and Part IV, which section 1(2) does not name among the provisions brought into force on 6 January 2012, so the detailed conditions for processing sensitive personal information await proclamation while the general prohibition in section 6(h) already binds.

When LexLint raises it

crawls_web
trains_models
automated_outreach
deploys_chatbot
handles_health_records

Read the law

Consolidated text of the Data Protection Act
Chap. 22:04, Ministry of the Attorney General and Legal Affairs, mirrored by the Trinidad and Tobago Cyber Security Incident Response Team

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app