A broad definition
Most privacy laws define personal data, sometimes called personal information, in broad terms: information that relates to an identified person, or to a person who could be identified. The wording differs between laws, and this article is a general description rather than legal advice, but the core idea is consistent. If information is about a person and can be linked to them, it is likely to count.
The word “could” matters. Data does not need to show a person’s name to be personal. If someone, using reasonable means, could work out who it describes, it will often fall within the definition.
Direct identifiers
Some details point straight to an individual. Examples include:
- full name
- home address, email address and phone number
- government-issued identification numbers
- employee, customer or account numbers
- photographs and video in which a person is recognizable
- voice recordings
- biometric data such as fingerprints or facial templates
These are the obvious cases, and most organizations already treat them with care.
Indirect identifiers
Details that look harmless alone can identify someone when combined. A job title, a workplace and an age range may single out one person in a small team. A postal code, birth date and gender, taken together, are often enough to pick out an individual in a population. Examples of details that can act as indirect identifiers include:
- date of birth, or even a rare combination of age and location
- job role in a small organization
- vehicle registration number
- unusual medical, educational or employment history
- a detailed description in free-text notes
Because of this, removing a name column does not automatically make a data set non-personal.
Technical and online identifiers
IT staff encounter many identifiers that do not look like personal details. Depending on the law and the context, these may count:
- IP addresses, particularly when the organization or someone else can link them to a subscriber or user
- cookie identifiers and advertising IDs
- device identifiers and MAC addresses
- usernames and login IDs
- location data from phones or vehicles
- browsing, search or purchase history linked to an account
- records in system logs that tie an action to a user, such as audit trails or web server logs
This means that a log file or analytics export can contain personal data even if nobody intended it to. Where such information flows into backups, test systems or vendor tools, it carries its status with it.
Information about, and opinions on, people
Personal data is not limited to facts that people supplied. It can also be:
- notes written about a person, such as a support agent’s comments or an HR review
- opinions and assessments, including performance ratings
- results generated by analysis, such as scores, profiles or predictions
- information inferred from other data, such as an assumed interest or credit risk
Such records can have a real effect on people, and in many places people can ask to see them.
Work and business context
The same rules usually apply to people acting in a professional role. A business email address that includes a person’s name, a work phone number and records of an employee’s activity are generally personal data about that individual. Information about a company itself, such as a registered business address, is typically not personal data, though sole traders and small firms can blur the line.
Sensitive categories
Many laws set aside special categories that receive more protection because misuse can cause greater harm. The list varies by place, but often includes information about:
- health and medical conditions
- racial or ethnic origin
- religious or philosophical beliefs
- political opinions
- trade union membership
- sexual orientation or sex life
- genetic and biometric data used to identify someone
- criminal records or allegations
- precise location, or information about children, in some laws
Financial account details and government identification numbers are not always in a legal “special” list, but organizations commonly treat them as highly sensitive in practice. These categories typically deserve the highest tier in a data classification scheme, stricter access, and extra care when sharing data with third parties.
De-identified, pseudonymized and anonymous
Three terms are often mixed up.
- Pseudonymized data has direct identifiers replaced by codes or tokens, with the key to reverse them kept separately. Because the person can still be re-identified using the key, this is generally still treated as personal data, although it lowers risk.
- De-identified data is a looser term, and its legal meaning varies. Some laws define it carefully and attach conditions, such as commitments not to re-identify.
- Anonymous data is data that can no longer reasonably be linked to a person by anyone, so that privacy laws generally no longer apply. True anonymization is difficult. Rich data sets can sometimes be matched against other information to re-identify people, so claims of anonymity should be tested, not assumed.
Techniques such as masking, aggregation and pseudonymization are part of data minimization, and they reduce but do not always eliminate privacy duties.
What generally is not personal data
Data that has no link to any individual, such as general weather readings, aggregate sales totals with large counts, or statistics that cannot be traced back to a person, is typically not personal. Even so, small groups can be a problem: a report showing results for a team of two may reveal individuals.
Why it matters for IT work
Knowing what counts as personal data decides which rules, safeguards and rights apply. Practical consequences include:
- you need to look beyond obvious fields when mapping where personal data lives
- logs, tickets, backups and test copies need the same care as production databases
- data inventories should include technical identifiers
- retention, access and security decisions should follow from what the data is, not just what it is called
When in doubt, treat information as personal until someone responsible for privacy tells you otherwise. Starting from a cautious assumption is usually less costly than discovering later that unprotected data was personal after all.