When special categories of data (sensitive data) are involved, the risk is by default higher. Special categories of data include (Article 9 GDPR): (a) data revealing racial or ethnic origin, (b) political opinions, (c) religious or philosophical beliefs, (d) trade union membership, (e) genetic data, (f) biometric data, (g) data concerning health and (h) data concerning a natural person's sex life or sexual orientation
Source: GDPR