What is personal data?
Personal data is information relating to an identified or identifiable natural person. It includes obvious identifiers such as names and identification numbers, but also online identifiers, device data, location, behavioural records, opinions, images and inferred characteristics when they can be connected to a person.
The concept is contextual. A code, IP address or unique pattern may identify a person when combined with other information. Data does not need to be confidential or correct to be personal data, and information in a professional context can still relate to an individual.
How is identifiability assessed?
Organisations should consider all means reasonably likely to be used by themselves or another recipient to identify the person. Cost, time, available technology, external datasets and the purpose of the processing may affect the analysis.
Replacing a name with an identifier does not automatically remove the data from privacy law if a key or other linking method exists. That information is more accurately described as pseudonymised.
What types of information are personal data?
Examples include contact information, account records, employment data, financial history, browsing activity, cookies, support conversations, photographs, voice recordings and scores or predictions about a person. Sensitive categories may receive enhanced protection.
Information about a household, device or company can also be personal data when it reveals something about an identifiable individual. Free-text notes often contain personal information not captured by structured field lists.
How should personal data be managed?
Organisations should define purpose and lawful basis, provide transparency, minimise collection, ensure accuracy, restrict access, apply security and set retention. Data inventories and maps help identify where personal data exists and which vendors or jurisdictions are involved.
New uses should be reviewed for compatibility and risk. Personal data should not become an unrestricted asset simply because it has already been collected.
Frequently asked questions
Is a work email address personal data?
Yes, when it identifies or relates to an individual, even though it is used in a professional context.
Is anonymous data personal data?
Genuinely anonymised data is generally not personal data under many frameworks, but anonymisation must prevent reasonable re-identification.
Are opinions personal data?
Yes. Opinions about a person and a person’s own opinions can both be personal data.
Is company information personal data?
Information about a legal entity alone may not be, but it can become personal when it identifies owners, employees or contacts.
Does inaccurate information count?
Yes. Incorrect information can still relate to a person and may create a right to correction.