When processing sensitive data, you must comply with all the requirements of the PDPL that are applicable to processing of any other personal data.
That said, please note that the PDPL has specific requirements for processing of sensitive data, for example:
1. You may not use legitimate interest as a lawful basis when processing personal data (as per Art. 6 (4) of the PDPL).
2. If you rely on consent as a lawful basis for processing of sensitive data, such consent must be explicit (as per Art. 11 of the Implementing Regulation to the PDPL).
3. In all circumstances, even with an individual’s consent, you may not process sensitive data for marketing purposes (as per Art. 26 of the PDPL).
4. PDPL provides for restrictions on the use of non-anonymized sensitive data for scientific, research, or statistical purposes (as per Art. 27 of the PDPL).