Personal data is information that relates to an identified or identifiable individual. It can be as simple as a name or a number, and can include an IP address or a cookie identifier. Special category data is personal data the UK GDPR treats as more sensitive, such as health, ethnic origin or religious beliefs, and it needs a lawful basis plus an extra condition to use. The Lift College GDPR Training course starts with what counts as personal data.
What counts as personal data
The ICO says personal data is information that relates to an identified or identifiable individual. Someone can be identified:
- directly, from the information itself, such as a name and address
- indirectly, by combining it with other information that you, or anyone else, could reasonably use
Identifiers can be a name, an ID number, location data, an IP address, a cookie identifier or other factors. Information also has to "relate to" the person, which depends on its content, why you are using it and its likely effect on them.
Examples
- a customer's name, email address or phone number
- a staff record with an employee number and pay
- a photo or CCTV image of a person
- notes about a learner's progress
- an IP address or cookie ID linked to a person's browsing
Pseudonymised and anonymous data
Information with identifiers removed or replaced (pseudonymised) is still personal data. Information that is truly anonymous is not covered by the UK GDPR. Inaccurate information about a person is still personal data, because it relates to them.
What special category data is
The UK GDPR gives extra protection to personal data revealing:
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
and to genetic data, biometric data used for identification, data concerning health, and data concerning a person's sex life or sexual orientation.
The ICO says these need care because using them can create significant risks to people's rights and freedoms. To use special category data you need both a lawful basis and an additional condition. Financial information can be sensitive, but it is not special category data.
Criminal offence data
Information about criminal allegations, convictions or offences is not special category data, but separate rules cover it, and it also needs a lawful basis and an additional condition.
When the UK GDPR applies
It applies to personal data processed wholly or partly by automated means, or held in a structured filing system. It does not cover processing by an individual for purely personal or household activities.
Training
Lift College GDPR Training is 2 hours in 5 modules, with a CPD Standards Office accredited certificate the same day you pass. Data Protection Training goes further on lawful bases and special data.