Personal data

What is personal data?

Personal data (defined similarly as personal information across various legal jurisdictions) refers to any information relating to an identified or identifiable living natural person (referred to as a "data subject"). A person is considered identifiable if they can be distinguished and recognized, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.

In modern digital marketing, customer relationship management, and corporate information governance, personal data serves as the lifeblood of customer acquisition and user experience personalization. Every website visit, email newsletter click, mobile app interaction, and e-commerce checkout generates personal data trails. However, because personal data directly touches individual human autonomy, privacy, and civil liberties, organizations are bound by strict legal frameworks governing how personal information is collected, processed, stored, transferred, and destroyed.

The legal spectrum of personal data: Direct and indirect identifiers

Under modern data privacy regulations (such as the EU General Data Protection Regulation and the California Consumer Privacy Act), personal data spans far beyond obvious contact details:

• Direct identifiers: Data points that immediately and unambiguously identify an individual on their own:

- Full legal name and home residential address. - Government-issued identification numbers (Social Security numbers, passport numbers, driver's license details). - Personal email addresses and personal telephone numbers. - High-resolution photographic portraits and facial recognition biometric templates.

• Indirect (pseudonymous) identifiers: Data points that do not reveal a person's name in isolation, but can be combined with other available information to identify a specific individual:

- Static and dynamic Internet Protocol (IP) addresses. - Unique mobile device advertising identifiers (Apple IDFA, Google Advertising ID). - First-party and third-party browser tracking cookie IDs. - GPS latitude-longitude geolocation coordinates. - Customer account numbers, loyalty card IDs, and device MAC addresses.

Special category and sensitive personal data

Global privacy legislation establishes a heightened tier of legal protection for "special category" or "sensitive personal data" due to the extreme risks of discrimination and harm if mishandled:

• Health and medical records: Clinical diagnoses, prescription histories, mental health therapy records, and fitness tracker biometric telemetry.
• Biometric and genetic data: Fingerprint scans, retina scans, voiceprint recordings, and DNA sequencing data processed for unique identification.
• Racial, ethnic, and religious identity: Data revealing racial or ethnic origin, religious beliefs, philosophical convictions, or political affiliations.
• Sexual orientation and personal relationships: Data concerning an individual's sex life, sexual orientation, or marital disputes.
• Trade union memberships: Information regarding an individual's membership in labor unions or professional advocacy bodies.
• Criminal offense records: Data relating to criminal convictions, alleged offenses, or judicial penalty proceedings.

Core principles of lawful personal data processing

Organizations that collect and process personal data must adhere to six foundational data protection principles codified in international privacy law:

• Lawfulness, fairness, and transparency: Data must be processed with a verified legal basis (such as explicit consent or legitimate interest) and presented to consumers with complete operational transparency via clear privacy notices.
• Purpose limitation: Personal data collected for a specific declared purpose (e.g., shipping an e-commerce order) cannot be subsequently repurposed for unrelated activities (such as selling to ad brokers) without fresh consent.
• Data minimization: Organizations must collect only the minimal amount of personal data strictly necessary to fulfill the declared operational purpose.
• Accuracy and data hygiene: Reasonable steps must be taken to ensure inaccurate or outdated personal data is corrected or deleted promptly.
• Storage limitation: Personal data must not be retained in identifiable formats longer than necessary to satisfy the original operational purpose.
• Integrity and confidentiality (security): Organizations must implement appropriate technical and organizational measures (encryption, role-based access controls) to prevent unauthorized access, loss, or destruction.

Fundamental consumer data privacy rights

Modern privacy legislation empowers consumers with enforceable legal rights regarding how corporations handle their personal data:

• The Right of Access (Subject Access Requests - DSARs): Consumers can formally demand that a company disclose whether it processes their personal data and provide a complete copy of all stored records free of charge.
• The Right to Rectification: The legal right to compel organizations to correct inaccurate or incomplete personal records immediately.
• The Right to Erasure ("Right to Be Forgotten"): Consumers can mandate that a business permanently delete all their personal data when consent is withdrawn or data is no longer operationally necessary.
• The Right to Data Portability: Demanding that personal records be provided in a structured, commonly used, machine-readable format (such as JSON or CSV) to facilitate transfer to a competing service.
• The Right to Opt Out of Sale and Profiling: Empowering consumers to prohibit companies from selling their personal data or using automated algorithms to make consequential credit, employment, or legal decisions.

Enterprise data governance and risk mitigation

Ensuring organizational compliance with personal data regulations requires robust technical and legal infrastructure:

• Data mapping and Record of Processing Activities (ROPA): Maintaining comprehensive data inventory audits that document where every personal data field originates, where it is stored, who accesses it, and when it is purged.
• Privacy by Design: Embedding data protection safeguards directly into software engineering roadmaps, database architectures, and product features from the earliest design stages.
• Vendor risk management: Executing formal Data Processing Agreements (DPAs) with all third-party SaaS vendors, cloud hosting providers, and marketing agencies handling company personal data.

Related terms

• Data privacy: The branch of data governance focused on handling personal data in compliance with regulatory mandates and consumer expectations.
• Personally identifiable information: Information that can be used on its own or with other data to identify, contact, or locate a specific individual.
• Consent mode: A technology protocol that allows websites to adjust how Google tags behave based on the consent status of the user.
• First-party data: Information collected directly by an organization from its own customers and website visitors through direct interactions.
• Data governance: The overarching framework of policies, processes, and standards ensuring data security, accuracy, and regulatory compliance.