The Central Government shall, in consultation with the Authority and the sectoral regulator concerned, notify such categories of personal data as "sensitive personal data", having regard to—
- the risk of significant harm that may be caused to the data principal by the processing of such category of personal data;
- the expectation of confidentiality attached to such category of personal data;
- whether a significantly discernible class of data principals may suffer significant harm from the processing of such category of personal data; and
- the adequacy of protection afforded by ordinary provisions applicable to personal data.