中华人民共和国个人信息保护法（第二十八条）

敏感个人信息是一旦泄露或者非法使用，容易导致自然人的人格尊严受到侵害或者人身、财产安全受到危害的个人信息，包括生物识别、宗教信仰、特定身份、医疗健康、金融账户、行踪轨迹等信息，以及不满十四周岁未成年人的个人信息。　　

只有在具有特定的目的和充分的必要性，并采取严格保护措施的情形下，个人信息处理者方可处理敏感个人信息。

Personal Information Protection Law of the People's Republic of China, Article 28

“Sensitive personal information” means personal information that,once leaked or illegally used, may easily result in the trampling of thepersonal dignity of natural persons or endanger personal or property security,including information on biometric identification, religious beliefs, specificidentity, medical health, financial accounts, and personal whereabouts, amongothers, and personal information of minors under the age of fourteen.​​

Personal informationprocessors may not process sensitive personal information unless there arespecific purpose and sufficient necessity and strict protection measures aretaken.​