The starting definition.
WHAT IT MEANS
Information relating to an identified or identifiable living person.
WHAT IDENTIFIABLE COVERS
Directly: a name, a photograph, a national identification number
Indirectly: anything that singles someone out when combined with other information
WHY INDIRECT IDENTIFICATION MATTERS
A record with no name can still identify one person.
WHAT EXAMPLES LOOK LIKE
An email address A phone number An account identifier A device identifier A network address, in many circumstances Location history
WHAT PEOPLE WRONGLY ASSUME IS NOT PERSONAL DATA
Business email addresses Information already public Data with names removed but everything else intact
WHY THE LAST ONE MATTERS MOST
Removing a name rarely prevents identification.
WHAT ANONYMISED MEANS
Altered so no person can be identified, by anyone, using any reasonably available means.
WHY THAT BAR IS HIGH
If re-identification is possible, it remains personal data.
WHAT PSEUDONYMISED MEANS
Identifiers replaced, with a key held separately.
WHAT THAT IS
Still personal data, with reduced risk.
WHAT TO ESTABLISH IN YOUR OWN SYSTEMS
Where personal data actually sits.
WHY THAT IS THE FIRST TASK
Everything else depends on knowing what you hold.
