Personal data

What counts as personal data?

Personal data is information about an identified or identifiable living person. It includes obvious details such as a name, home address or work email, but the test is wider. A payroll number, absence date, performance note or manager's opinion can all be personal data when they relate to someone.

The connection comes from the information's content, purpose or effect, not simply whether a name appears. The ICO's explanation of personal data also makes clear that identification can be direct or indirect. Information about a company or someone who has died is not personal data in itself, although a record about an identifiable director, sole trader or employee may be.

Names are not the only identifiers

Ask whether your organisation, or another party likely to receive the record, could reasonably identify the person using other available information. A unique staff code may be enough when a separate payroll file connects it to a name.

Pseudonymised information remains personal data while that connection can be restored. This matters when teams replace names in reports, exports or test files but retain the lookup key elsewhere.

Decide whether a record is truly anonymous

Removing a name is only the start. Consider the details left behind, who can access other records and whether combining them could reveal the person. Truly anonymised information falls outside this definition only when nobody can identify the individual by means reasonably likely to be used.

For a practical inventory, record what you hold, where it lives, who it concerns, why you need it, who can see it and what could reconnect it to a person. That gives you a sound basis for deciding which privacy, access and retention controls apply.