The PDPL has the following definition of personal data.
Article 1 (4) of the PDPL
Any data, regardless of its source or form, that may lead to identifying an individual specifically, or that may directly or indirectly make it possible to identify an individual, including name, personal identification number, addresses, contact numbers, license numbers, records, personal assets, bank and credit card numbers, photos and videos of an individual, and any other data of personal nature.
This means that personal data is any data based on which it is possible to identify an individual, for example an individual’s telephone number, name or email address.
If it is impossible to identify a particular individual from the data in question, then such data is not personal data and its use is not regulated by the PDPL.
Example | Personal data
An organization’s HR department stores data about each employee, including name, date of birth, job grade, personal phone number and educational qualifications. This data is considered personal data and its use is regulated by the PDPL.
Example | Non-personal data
A company’s marketing department analyzes the purchase behavior of its customers between the ages of 20 and 30 for analytics purposes. The marketing department only has data about the products and the price of items purchased by this age group. The marketing department is unable to identify any individual purchaser.
Therefore, such data is not personal data. Its use is not regulated by the PDPL.
Example | Non-personal data
An automotive company has a database of its authorized dealerships (commercial organizations). The database has data on how many cars each dealership sold during the last year. The database also contains prices for which the dealerships purchase the cars for further resale.
The data on the volume of sales and the price of cars is not personal data. Its use is not regulated by the PDPL.