GDPR: what are personal data?

Personal data

The GDPR applies to the use of personal data. The definition of personal data in the context of this law is therefore of great importance.

Personal data are any information about an identified or identifiable natural person. A natural person is considered to be identifiable if he or she can be identified directly or indirectly. Information that at first sight does not appear to be traceable to a person can therefore be personal data according to the definition of the GDPR. This may be the case if the information can be traced back to the person in question, eg by combining the data with other, or additional, data.

Some examples of 'normal' personal data include: name, address, e-mail address, photo, ID number, IP address, employee number, private or professional telephone number (who’s who), login data, identification cookies, account number, CV, log data (including cafeteria, parking use, web use, surfing), camera images, personnel files, wage data, professional expenses, etc.
Please note: data that at first sight does not directly lead to (identification of) a person can also be personal data. For example, data about a person's reaction times to a task, brain activity (e.g. EEG), blood sugar level, personality, skin conductance and heart rate are also (sensitive) “personal data” when there is also information that this data (whether or not pseudonymised) to the natural person. links. (See also below under Pseudonymized and Anonymized data)

Data concerning deceased persons or organisations are not personal data according to the GDPR and therefore fall outside the scope of the GDPR. Other laws and regulations may, however, apply to these data.

Special categories of personal data (sensitive personal data)

The processing of sensitive personal data entails a higher risk and potentially bigger impact on the rights and freedoms of the data subject(s). Special categories of personal data (sensitive personal data) are the following personal data: personal data revealing racial or ethnic origin, political views, religious or philosophical beliefs, membership of a trade union, genetic data, biometric data, data about health or someone's sexual behavior or sexual orientation.

Pseudonymised personal data

Pseudonymised personal data is personal data that has been pseudonymised (this was referred to as "coding" in the previous Privacy Legislation). Pseudonymisation of personal data means that they are processed in such a way that the personal data can no longer be linked to a specific data subject without additional data being used. It is important to keep this additional data separately and to take the necessary technical and organizational measures to ensure that the personal data cannot be linked to an identified or identifiable natural person.

Pseudonymised personal data are still personal data protected by the GDPR. In this case, the criterion is not whether the pseudonymised dataset reveals who is who, but whether the data - with or without additional information sources - can be traced back to an identifiable natural person. In research, pseudonymisation is typically achieved by "obscuring" all identifiable elements (removing, replacing, generalizing, ...) and where possible separating them from the research data in a separate key file that is securely stored in a separate place. If necessary, both the key file and the research data contain a unique but arbitrary code so that the link can be made between the data subjects and the pseudonymised research data.

Anonymised personal data

With anonymised personal data, the possibilities for identification have been 'irreversibly' removed by means of a processing technique.

It is important to evaluate whether the data can be related to an identified, or identifiable, person. Data that cannot be traced back to the original individuals with reasonable effort are anonymous data. However, data that can be traced back to the original individuals with reasonable effort are not anonymous data - after all, it is traceable to an identifiable person. They therefore remain “personal data” according tot the definition of the GDPR and this legislation therefore applies to this data.

For this reason, it is difficult to truly anonymise many types of research data (for example: qualitative data, large data sets with a wide range of personal data, etc.).

Please note that if you do anonymise personal data yourself, you must of course work with identifiable personal data at the start and during anonymisation and the GDPR remains applicable. This means that you must meet the requirements of the GDPR, starting with registering your processing activity.

Anonymous data

Anonymous data is data that does not relate to an identified or identifiable natural person or to personal data that has been made anonymous in such a way that the data subject is not or no longer identifiable (by any individual in any way).

Anonymous data are not personal data and do not fall under the scope of the GDPR.

Please note: even if you only process anonymised data, it is still important to evaluate the ethical aspects of collecting or processing that data.