The possibility to collect, store, and process equality and participation data is regulated through various data protection regulations. On a national and international level efforts are being made to protect personal and particularly ‘sensitive data’. The aim is to prevent abuse, or to be able to sanction it within the existing legal framework.

In Germany data protection is regulated through the Federal Data Protection Act, and through a precedent by the Constitutional Court dealing with ‘informational self-determination’. The state data protection laws are only applicable within the respective state administrations. On the EU level the Data Protection Directive 95/46/EG,  and the Charter of Fundamental Rights of the European Union constitute the main legal framework pertaining to personal and sensitive data.

In international law Data protection standards are set by the ‘Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data’ and the Council of Europe’s European Convention on Human Rights. Moreover, the UN International Covenant on Civil and Political Rights includes the protection of privacy.

Personal data, such as ethnic origin and religion are considered ‘sensitive data’, and are therefore subject to special legal protection. The collection of such data may only be carried out on a voluntary basis, and through self-categorization. After its collection, sensitive data must be anonymised. Publishing such data is only allowed if disaggregated and represented through specific characteristics within complex data sets (such as nationality, occupation, marital status, etc.)