Glossary
What counts as personal data
More things than you would think, which is why who can see them matters.
Personal data
Any information that allows a specific person to be identified, directly or by combining it with something else. Not only their name and ID number.
The list is longer than people assume, and it is the reason that inside a platform like this you have to think about who sees what.
Things that count and get forgotten
| Item | Personal data? |
|---|---|
| Name, identity document | Yes, obviously |
| Work email and phone | Yes |
| Bank account number | Yes |
| A vehicle registration | Yes, if it leads to the person |
| A worker's training certificate | Yes, it is in their name |
| A company's tax number | No, that belongs to the company |
Important
Health data, data about minors and data on convictions carry heightened protection. If you will handle them — a medical check, training for a minor on placement — do not treat it as just another document: decide expressly who may see it.
The rule that settles most of it
Ask for the minimum you need for what you are doing, keep it as long as necessary and no longer, and let only the people who must see it see it. That covers most day-to-day situations.
Watch out
This is not legal advice. The specifics of your situation come from your adviser or data protection officer.
›Can I ask a supplier for an ID document?
If you need it for what you are doing, yes. If not, better not to hold it.
›What about a copy of a driving licence?
Only if the role or service requires it.
›Does keeping less leave me less covered?
No. Keeping what you do not need is risk with no upside.
A real case
The situation
A company keeps ID copies for every candidate it interviews.
What you do
- Decides to keep only those of people who join
- Applies the rule to the existing backlog
What you get
It stops holding hundreds of identity documents it had no reason to hold.
The situation
An identity document is stored without knowing why it is needed.
What you do
- Reviews what justifies keeping it and for how long
What you get
What is kept has a reason and a period.
The situation
The whole team can open documentation containing sensitive data.
What you do
- Limits who sees what according to their work
What you get
Access stops being a matter of general trust.
The situation
A whole file is shared when only one document was needed.
What you do
- Shares only what is relevant
What you get
What was asked for is handed over, and nothing more.
The situation
A candidate asks for their data to be deleted.
What you do
- Locates where it sits and acts on the policy
What you get
The request is handled without searching everywhere.
The situation
Nobody knows how long each document type is kept.
What you do
- Sets a retention policy and applies it
What you get
The decision is taken once and stops being improvised.
This article answers
- what is personal data gdpr
- is an id number personal data
- can i store an employee's phone number
- suppliers' personal data