Personal Data

The definition of "personal data" is fundamental to understanding the Act and the obligations it imposes on data controllers and the rights it provides for individuals.

What the law says:

 "personal data" means data which relate to a living individual who can be identified —

(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

What it means:

Personal Data is information about a living person who can be identified from the information on its own or when combined with other information.

It is important to note that, where the ability to identify an individual depends partly on the data held and partly on other information (not necessarily data), the data held will still be “personal data”. Personal data can therefore include CCTV, vehicle number plates, IP addresses, any pseudonyms for the person or the use of initials to identify an individual to a specific group of people.

The definition also specifically includes opinions about the individual, or what is intended for them.

For example: A manager’s assessment or opinion of an employee’s performance during their initial probationary period will, if held as data, be personal data about that individual. Similarly, if a manager notes that an employee must do remedial training, that note will, if held as data, be personal data.

The definition of personal data was considered in the Durant case and a guidance note on this has been produced specifically in relation to that case and is available below together with further advice on deciding whether data is "personal data" or not for the purposes of complying with the Act.


For public authorities subject to the Freedom of Information Act ONLY:

Information in unstructured files ("category (e) data") from which an individual can be identified on its own, or when combined with other information in the public authorities' possession, will be personal data and the right of access described in section 7A of the Data Protection Act applies to that personal data.

Section 29A of the Data Protection Act describes which sections of the Act apply to "category e data".