Article 70 of the Data Protection Act requires a data controller to process and store sensitive personal data on a server or data centre located in the Republic. Sensitive personal data include: (a) the race, marital status, ethnic origin or sex of a data subject; (b) genetic data and biometric data; (c) child abuse data; (d) a data subject’s political opinions; (e) a data subject’s religious beliefs or other beliefs of a similar nature; (f) whether a data subject is a member of a trade union; or (g) a data subject’s physical or mental health, or physical or mental condition.