The Law on Personal Data provides that information recorded on a material carrier relating to a particular person, which identifies a specific person or which could be used to identify a specific person, directly or indirectly, by reference to one or more factors related to biological, economic, cultural, civil or social identity shall qualify as 'personal data'. 

Personal data include:

• Biographical and identification data;
• Personal characteristics;
• Information on marital status;
• Financial status;
• Health data.

There is no clear definition of Sensitive Personal Data. Under the provisions of the Law on Personal Data, all personal data is confidential. It should be noted that the Holder (Owner) of personal data (ie the data controller) and the data processor are obliged to ensure protection of personal data to prevent:

• Unauthorized access;
• Blocking;
• Transmission;
• As well as its accidental or unauthorized destruction;
• Alteration or loss;
• Provide guarantees in respect of technical security measures and organizational measures regulating processing of personal data.

However, confidentiality of personal data does not apply in cases of anonymisation or on request of the individual to which the personal data relates.