The Act’s definition of “personal data” covers any data that can be used to identify a living individual. Anonymised or aggregated data is not regulated by the Act, providing the anonymisation or aggregation has not been done in a reversible way.
Individuals can be identified by various means including their name and address, telephone number or Email address.
The Act defines special categories of personal data (previously referred to as sensitive personal information) as information related to:
- Race or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic data
- Biometric data
- Health data
- Sexual history and/or sexual orientation
- Criminal data