---
kind: "section"
citation: "28 C.F.R. § 202.249"
title: "28"
number: "202.249"
heading: "Sensitive personal data."
url: "https://uscodex.org/cfr/28/202.249"
---

# §202.249. Sensitive personal data.

- (a) **Definition.** The term sensitive personal data means covered personal identifiers, precise geolocation data, biometric identifiers, human `omic data, personal health data, personal financial data, or any combination thereof.
- (b) **Exclusions.** The term sensitive personal data, and each of the categories of sensitive personal data, excludes:
  - (1) Public or nonpublic data that does not relate to an individual, including such data that meets the definition of a “trade secret” (as defined in [18 U.S.C. 1839(3)](/usc/18/1839.md?p=3)) or “proprietary information” (as defined in [50 U.S.C. 1708(d)(7)](/usc/50/1708.md?p=d-7));
  - (2) Data that is, at the time of the transaction, lawfully available to the public from a Federal, State, or local government record (such as court records) or in widely distributed media (such as sources that are generally available to the public through unrestricted and open-access repositories);
  - (3) Personal communications; and
  - (4) Information or informational materials and ordinarily associated metadata or metadata reasonably necessary to enable the transmission or dissemination of such information or informational materials.

## Notes

### Authority

Authority: 50 U.S.C. 1701 et seq.; 50 U.S.C. 1601 et seq.; E.O. 14117, 89 FR 15421.

### Source

Source: 90 FR 1706, Jan. 8, 2025, unless otherwise noted.