How can we help?


Personal Data FAQs

What is personal data?

Personal data refers to any information related to an identifiable living individual.

That individual has to be identified or identifiable, directly or indirectly, from one or more identifiers (such as  a name, an identification number, location data, an online identifier) or from factors specific to the individual (such as physical, physiological, genetic, mental, economic, cultural or social identity).

The person in question is often referred to as a ‘data subject’.

 Are there different categories of personal data?

Some personal data, referred to as ‘special category data’ is treated as being more sensitive, and therefore requires a greater level of protection.  This is information about the data subject’s:

  • Race
  • Ethnic origin
  • Political opinions
  • Religious or philosophical beliefs
  • Sexual orientation or sex life
  • Genetic data
  • Biometric data
  • Trade union membership
  • Health data

Information about criminal convictions and offences is also treated as requiring greater protection.

What is a data controller and a data processor?

A data controller is a legal person, public authority, agency or other body that determines the purposes and means of processing personal data.

A data processor is a person, public authority, agency or other body that processes data on behalf of the data controller.

An entity can be both a data controller and data processor.

Sana Nahas

Trainee Solicitor

View profile

‪+44 118 960 4611

Personal data refers to any information related to an identifiable living individual.

 What is the legal basis for processing personal data?

Data controllers must have a valid legal basis to process personal data. There are six legal bases:

  • Consent – the data subject has given consent to the processing
  • Contract – the processing is necessary for the performance of a contract to which the data subject is a party (or in order to take steps at the request of the data subject prior to entering the contract)
  • Legal Obligation – the processing is necessary to comply with a legal obligation to which the data controller is subject
  • Vital Interests – the processing is necessary to protect the vital interests of the data subject or another person (this is usually used in cases of life and death)
  • Public Task – the processing is necessary to perform a task in the public interest or in the exercise of official authority vested in the data controller
  • Legitimate Interests – the processing is necessary for the controllers (or third party’s) legitimate interests except where these are overridden by the interests or fundamental rights and freedoms of the data subject. This involves balancing the data controller’s interests against the data subject’s rights.

If a data controller is processing special category data or data related to criminal convictions, it needs to identify a lawful basis for the processing but also satisfy an additional condition relating to the processing.

What rights do individuals have regarding their personal data?

Right to be informed: individuals have a right to be given certain information about their personal data and how it is processed. This includes information on the purposes for processing personal data, details of who has access to this and retention periods that apply to that data.

Right of access: individuals may request access to their personal data held by an organisation.  Requests are made via a data subject access request.

Right to rectification: individuals may request that inaccurate or incomplete personal data held about them is rectified or completed.

Right to erasure: individuals may request the deletion of their personal data in certain circumstances.

Right to restrict processing: individuals may request that the processing of their personal data is restricted in certain circumstances.

Right to data portability: individuals have the right to receive their personal data (which they provided to the data controller) in a structured, commonly used and machine-readable format.  They also have the right to request that the data controller transmit this data to another data controller.

Right to object: individuals have the right to object to specific processing activities in certain circumstances.

Rights related to automated decision making: individuals have the right not to be subject to a decision based solely on automated means without any human involvement, if the decision produces legal effects concerning the individual or similarly significantly affects them.

If your organisation needs help, contact our Data Protection team here.

About this article

This information is for guidance purposes only and should not be regarded as a substitute for taking legal advice. Please refer to the full General Notices on our website.

Sana Nahas

Trainee Solicitor

View profile

‪+44 118 960 4611

About this article

Read, listen and watch our latest insights

  • 22 April 2024
  • Privacy and Data Protection

Think tank study finds that up to 8 million jobs may be at risk from AI

Injuring someone’s feelings through acts of discrimination, harassment or victimisation can be a costly business.

  • 26 March 2024
  • Privacy and Data Protection

AI Podcast: AI and Data Security

In the third and final podcast in our ‘AI Podcast’ trilogy, members of the data protection team, will be discussing how to use AI to process data safely. They will be looking closely at the risks for businesses and the types of data security protections you can put in place.

  • 26 March 2024
  • Privacy and Data Protection

Key considerations for data retention policies

In the ever-evolving landscape of data protection regulations, data retention stands as a crucial aspect of compliance and risk management for organisations across industries.

  • 18 March 2024
  • Privacy and Data Protection

Consent or pay: Issues and considerations, Meta’s potential breach

The ICO has stated that any organisation considering using “consent or pay” must ensure that the consent to processing of personal data for personalised advertising is being given freely, and is fully informed.

  • 13 March 2024
  • Privacy and Data Protection

21 March 2024 Deadline: Are your international data transfer agreements compliant?

If your organisation transfers personal data from the UK to another country, it needs to comply with statutory requirements to ensure adequate levels of protection for that data are in place.

  • 06 March 2024
  • Privacy and Data Protection

Personal Data Breaches – How do I deal with them?

This article will provide an overview of the steps to take when experiencing a personal data breach.