This article was published in 2019. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
In the GDPR, we find the following definition of personal data:
The arrival of the General Data Protection Regulation (GDPR) raises the question of which data do and do not fall under this legislation. The rules and obligations of the GDPR apply to all information relating to “an identified or identifiable person.” But what is personal data?
What is personal data under the GDPR?
“Any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”
This means that all information directly relating to an individual is personal data. This includes data such as a person’s name, address, place of residence, telephone number and date of birth. Customer numbers, payslips, photographs, business telephone numbers, fingerprints, DNA data and email addresses are also personal data.
Special categories of personal data
Sensitive data such as a person’s race, religion or health are referred to as special categories of personal data. These enjoy additional legal protection.
In addition, there are data such as a vehicle registration number, data from the Land Registry or the data of a laptop or mobile phone. Consider, for example, the registration number (IMEI number) or MAC address. These data are also regarded as personal data. What is essential here is that these data can be traced back to a natural person.
How do I know whether something is personal data?
To determine whether something is personal data, you do not only look at the data item as such. Personal data can arise in various ways, for example through linking different sources. A car’s registration number, for instance, is not personal data as such. This changes if an organisation has access to the database of the RDW (the Dutch vehicle authority). The registration number can then be linked to a person, which makes the information personal data for that organisation. The same applies to IP addresses and location data from mobile phones. The use of big data can also involve personal data. By linking different data, information can become directly or indirectly traceable to an individual.
There are a great many types of personal data. Under the GDPR, the information must relate to a natural person. Data about organisations, such as legal entities, foundations and associations, are not personal data. However, information about the persons involved in these organisations, such as employees or directors, is regarded as personal data.