According to the GDPR, personal data refers to any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or one or more specific factors that characterize the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
Therefore, personal data includes not only identifying information about a person (name and surname) or address data (residential address). It can take various forms, such as a phone number (including a work phone), an email address (for example, [email protected]), a photograph (e.g., on an ID badge), recordings of both voice (e.g., on a helpline) and image (through video surveillance operating in your company), specific physical characteristics (e.g., measurements of work clothing), fingerprints (e.g., on the iPhone you use), retina scans (e.g., in an access control system), and even an IP address or notes included on a job candidate's CV. All of this data may be considered personal data.
In summary:
personal data encompasses all information that your company collects about its employees, clients, or contractors.
We will be dealing with personal data whenever such data allows for the identification of a specific person, even if it requires some effort and the acquisition of additional information (an identifiable natural person). This refers to any reasonably likely means that could be used to identify a natural person.
This concept is not limited in any way, and what falls within its scope may change depending on technological advancements. However, the determining factor for whether we are dealing with personal data is whether the information in question can be attributed to a specific person. If that is the case, then we are indeed dealing with personal data.
