

However, many organisations are still unsure exactly what ‘personal data’ is. That’s a concern, because if organisations don’t meet their compliance requirements, they risk data breaches and disciplinary action. Yet, we can understand why organisations continue to struggle with this aspect of the GDPR – particularly if they don’t have a dedicated data protection professional on their books. #WORD WRAP IN MEMO FIELD OF SAGE ACT PRO V17 PROFESSIONAL# It is up to organisations to correctly interpret the GDPR’s definition:Įrsonal data’ means any information relating to an identified or identifiable natural person (‘data subject’) The issue is that the Regulation doesn’t provide a definitive list of what is or isn’t personal data.

The GDPR further clarifies that information is considered personal data whenever an individual can be identified, directly or indirectly, “by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.” In other words, personal data is defined as any information that is clearly about a particular person. In certain circumstances, someone’s IP address, hair colour, job or political opinions could be considered personal data. The qualifier ‘certain circumstances’ is worth highlighting, because whether information is considered personal data often comes down to the context in which it is collected. Organisations usually collect many different types of information on people, and even if one piece of data doesn’t individuate someone, it could become relevant alongside other information.įor example, a data controller that requests information on people who download products from their website might ask them to state their occupation. #WORD WRAP IN MEMO FIELD OF SAGE ACT PRO V17 DOWNLOAD# #WORD WRAP IN MEMO FIELD OF SAGE ACT PRO V17 DOWNLOAD#.#WORD WRAP IN MEMO FIELD OF SAGE ACT PRO V17 PROFESSIONAL#.

