What is personal data?

WHAT IS PERSONAL DATA?

________

Personal data lies at the heart of GDPR and other data protection legalisation, but many organisations are often confused as to what is and what isn’t considered to be personal data.

The definition from GDPR for personal data is:

“‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

Which to many is as clear as mud. So let’s break that down to something more understandable.

A person under GDPR is anyone that is alive and a citizen of an EU country. Personal data is any information that can be used to work out who that person is.

The “directly identifiable” part or the “indirectly identifiable” part of the GDPR definition refers to how you work out who the person is.

Directly

Covers any information about them, the most obvious example of identifying someone directly is their name.

Indirectly

means that you would need to do additional work to identify them, for example, a vehicle’s registration number does not directly identify a person but because people must register themselves as a vehicle keeper, you can use the registration number to find out who someone is.

So, now that we understand the meaning a bit better let’s consider some practical examples.