Start by identifying the information, the person it relates to and who decides why it is used. That determines whether data-protection rights apply and who must answer.
Key points
- Personal data can identify someone directly or indirectly.
- Opinions, identifiers, location, device data and inferences can all qualify.
- Special category and criminal offence data require additional conditions and safeguards.
- A controller decides purposes and means; a processor acts on a controller’s instructions.
- Truly anonymous data is outside the regime, but pseudonymised data is still personal data where re-identification is possible.
Direct and indirect identification
A name is the obvious example, but an account number, cookie identifier, IP address, vehicle registration, voice recording or combination of facts may also single someone out. The question is whether the information relates to an identifiable living person in context, using means reasonably likely to be available.
Personal data can describe what happened, record an opinion, predict behaviour or reveal how an organisation treats a person. An internal risk flag may be personal data even if the organisation considers the model confidential.
Special category and criminal offence data
Information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric identification data, health, sex life or sexual orientation is special category data. An organisation normally needs both an Article 6 lawful basis and an Article 9 condition. Criminal offence data has separate protection under Article 10 and the DPA 2018.
Calling data “sensitive” in ordinary language is not the legal test, although other intimate or financial data may still create high risk and demand strong security.
Controllers, joint controllers and processors
The controller is the organisation that decides the purposes and essential means. A service provider may be a processor for one activity and a controller for another. Two organisations may be joint controllers if they jointly determine the processing. This matters because rights requests and complaints should reach the organisation responsible for the decision in issue.
Documents are containers, not the legal unit
A whole document is not automatically personal data. One email can contain your personal data, another person’s data, confidential business material and non-personal information. A SAR right attaches to the personal data. Redaction or extraction can therefore be legitimate, but the organisation should not use the document boundary to avoid disclosing the personal data within it.
Build the record
Turn the concern into answerable questions
- Identify the exact personal data or processing activity.
- Record dates, systems, people and any decision or disclosure affected.
- Choose the right legal tool for the outcome you need.
- Ask for a reasoned answer and a specific corrective action.
- Keep the request, acknowledgement, evidence and final response together.
If several rights are involved, number them separately. A request for access, a request to correct data and a complaint about previous handling can run alongside one another, but they have different legal tests and may have different deadlines.
Worked examples
| What happened | The data-protection question | Likely next route |
|---|---|---|
| An internal email calls you “high risk” | The label and reasons may be personal data about you. | Subject Access Requests and automated decisions |
| A company removes your name but keeps a unique customer code | The data may be pseudonymised, not anonymous. | Access, transparency and security |
| A payroll bureau processes payslips for your employer | The employer is usually the controller for payroll; the bureau may act as processor. | Employment data and complaints |
Useful wording
“Please confirm whether you treat [information] as personal data relating to me, who the controller is for this processing, the purpose for which it is used, and whether any special-category or criminal-offence condition applies.”
Keep the request focused on the data or processing activity. Ask the organisation to identify its position and the corrective action it will take. Keep a copy and proof of delivery.
Official sources
Check the rules behind this guide
These are official or primary sources. Check the current text before relying on a formal deadline, procedure or court route.