Personal data: what counts, and what people get wrong

Most organisations hold more personal data than they believe, because they picture a customer database and forget everything else. The definition in force across most of the world is deliberately broad: information relating to an identified or identifiable living person. The second word does the work — identifiable means by any means reasonably likely to be used, including by combining your data with something else.

What counts as personal data

• The obvious: name, address, email, phone, photograph, date of birth.
• Identifiers that look technical: an IP address, a device identifier, a cookie identifier, an account number.
• Information about a person even without their name attached, where the person can still be singled out — "the only female engineer in the Bristol office" identifies somebody.
• Opinions and assessments: appraisal notes, a credit decision, a comment in a ticket about a difficult customer.
• Business contacts. A work email at a named company is still about a person in most regimes.
• Data you inferred rather than collected, which is a category people reliably forget.

Special categories need a stronger basis

A narrower set carries extra protection: health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic and biometric data, sex life and sexual orientation. Small companies hold more of this than they expect — sickness absence records are health data, dietary requirements for an event can reveal religion, and a union deduction on payroll is trade union membership. Processing these needs a specific additional condition rather than the general one you rely on for everything else, and the usual mistake is not refusing to hold them but holding them without ever having identified them as special.

Pseudonymised is not anonymised. If you keep a key that lets you re-identify somebody — or if anybody could by combining your file with another — the data is still personal and the obligations still apply. Genuinely anonymised data is hard to produce and rarer in practice than in privacy notices.

Where small companies actually hold it

1. Payroll and HR files, which contain the most sensitive material in most organisations.
2. The shared mailbox, which quietly becomes the largest unmanaged store in the building.
3. Recruitment: CVs from unsuccessful candidates kept for years with no decision about retention.
4. CCTV, door entry logs and vehicle tracking, which are often owned by nobody.
5. Spreadsheets on individual machines, which is where a data map stops matching reality.
6. Backups, which are frequently forgotten in retention and deletion promises.

The practical consequence

Breadth means the useful question is not whether you hold personal data but where, why, and for how long. A short record of what you hold and on what basis answers most regulatory correspondence and all of the internal arguments — and it is the thing you cannot produce in a hurry when a request or an incident forces the question.

Ettex Records suits that inventory: what is held, where, the lawful basis, the retention period and the owner, with special categories flagged as such. Keeping it beside the privacy policy means the published promises and the actual holdings can be checked against each other, which is the comparison that usually goes unmade.