Key Concept 1 — Personal Data
If you can tell who a piece of information is about, it is personal data.
Personal data is any information that relates to an identified or identifiable natural person. The definition is deliberately broad, and it is the same idea in almost every data protection law.
- Direct identifiers: name, ID or passport number, photo, e-mail address with a name
- Indirect identifiers: customer or employee number, phone number, licence plate, IP address, device ID, cookie ID
- Information about a person: salary, performance reviews, purchase history, location data, opinions about the person
- Combinations: job title + department + location can point to one person, even without a name
- Not personal data: data about companies (e.g. a company's turnover), truly anonymous statistics, and in most laws data about deceased persons
- Identifiable data: "Maria López, customer 4711, bought a laptop" — fully covered by the law
- Pseudonymised data: "Customer 4711 bought a laptop" — the key to re-identify the person still exists somewhere, so it is still personal data. Pseudonymisation is a good security measure, not an exit from the law.
- Anonymised data: "35% of customers in Lima bought a laptop" — nobody can identify the person with reasonable effort, so the data falls outside data protection law
- Rule of thumb: anonymisation must be irreversible. Small groups, rare attributes or linkable data sets often allow re-identification.