Personal Data vs. Sensitive Data, in Plain English

Two terms, one important difference.

Personal data is anything that identifies a person: a name, an email address, an ID number, a photo of their face. If it points to someone, it's personal data.

Sensitive data is the subset that needs extra care: health information, religious or political beliefs, biometric data, precise location. Frameworks treat this category strictly because misuse here causes real harm.

Why does this matter for your AI project? Because the guardrails scale with the sensitivity. A model working with email addresses needs care. A model working with health records needs much more: tighter access, stronger justification, clearer consent, shorter retention.

Before you start, sort your data into these two buckets. Most teams discover they've been treating sensitive data like ordinary data.

The label tells you how careful to be.

I explain frameworks; I don't give legal counsel.