What is personal data?

What it is

The UK GDPR defines personal data as information relating to an identified or identifiable natural person. Identification can be direct, such as a name, or indirect, such as a staff number, a device identifier or a combination of details that points to one person. Opinions about someone are personal data as much as facts. Information about the dead, about companies, and data that has been truly anonymised is not.

When information counts as personal data

• It names a living person, or relates to a person you can identify by means reasonably likely to be used, including by combining it with other information. UK GDPR Art 4(1); Recital 26
• It is an online identifier, location data or a device or cookie ID that can be linked to an individual. UK GDPR Art 4(1)
• It is pseudonymised: replacing names with codes still leaves personal data where the key exists. UK GDPR Art 4(5); Recital 26
• It is held on a computer, or in a structured manual filing system. Public authorities are also covered for unstructured manual records. UK GDPR Art 2; DPA 2018 s.21

When it is not personal data

• Information about people who have died. DPA 2018 s.3(2)
• Information about a company or other organisation, unless it also identifies a living individual such as a sole trader.
• Data anonymised so that no one can be identified by any means reasonably likely to be used. Recital 26
• Processing by an individual for purely personal or household activities. UK GDPR Art 2(2)(a)

Who is responsible

Every organisation and sole trader that decides how and why personal data is processed (the controller), and any processor acting for one. The test is applied to the data you hold, not to your size.

What it involves

1. Map what you hold and where it came from.
2. Check whether each data set identifies people, alone or with other data you have or could get.
3. Treat pseudonymised data as personal data.
4. Identify any special category or criminal offence data, which carries extra conditions.

If it goes wrong

Regulatory

Treating personal data as if it were outside the law usually means no lawful basis, no privacy notice and no security planned for it, each a separate infringement. A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change.

Criminal

Knowingly or recklessly obtaining or disclosing personal data without the controller's consent is an offence under DPA 2018 s.170, and re-identifying de-identified personal data is an offence under s.171. Both carry an unlimited fine.

Civil

Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168.