The main difference between GET and POST requests is that in GET requests a third person can see the information passed to the application just by viewing the url, something that doesn't happen with POST requests. This is why it's considered better and safer to use POST instead of GET http-method for sensitive data.
Have in mind though, that from a security perspective if someone by any mean manage to execute successfully e.g. a MITM attack to the network, he will be able to retrieve not only GET but also POST parameters/data, so make sure that when you pass sensitive data to your application - you pass them encrypted - so https combined with HSTS in this case plays a very important role to protect your application and clients from remote attackers.
Now about what's considered sensitive data? I'm not a lawer, but I believe that sensitive are the data that should be protected by any unauthorised access. Also that depends on the application. For example facebook allows authenticated users to view some of your information (if you set your settings to do so) - so in this case it's up to the user to select what to share and what to keep private (of course some things must be kept private, like passwords, social security numbers, credit card numbers etc...).
Also if some of the user's information are used by the application's functionality and must be passed to the application frequently (e.g. user's email for authentication) but they don't need to be visible then it's better to hide them and when needed pass them to your application using POST instead of GET. In this way you can prevent (or at least discourage) some kind of attacks like brute-force attacks. Imagine that the complexity of such an attack reduces from O(n^2) to O(n) when the attacker knows either the username or the password and doesn't have to guess the correct combination.