Definitions

Personal data: Any information relating to an identified or identifiable natural person, whereby the person can be identified, directly or indirectly.

This may, for example, include photographs, email messages and data recorded by closed-circuit television (CCTV), if a person can be identified from this.

It also includes data identified by reference numbers, where a separate list can be used to match the reference numbers to named individuals. It, however, does not mean that all information provided during research by a person (e.g. During interviews) is personal data. If a person cannot be identified directly or indirectly from the information, then the information is not defined as personal data.

Identifiable natural person: One who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Special categories data: Personal data that is combined with information on a person’s race, ethnic origin, political opinion, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, sex life or sexual orientation.

Data controller: A person or organisation who determines the purposes for which and the manner in which personal data are processed.

Data processor: A person who processes data on behalf of the controller.

Data processing: Any operation performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or making available, alignment or combination, restriction, erasure or destruction.

Pseudonymisation: Processing the personal data in such a manner that it can no longer be attributed to a specific data subject without the use of additional information, which needs to be kept separately and subject to technical and organisational measures.

For example, if you de-identify individuals in a survey by giving each respondent a numeric identifier, the data will technically remain personal and under the UK GDPR be classified as pseudonymised data, if you (the data controller) have another file which links that numeric information to the real names or other personal information.

If you destroy the linkage key between the identifiers and the personally identifying information, then it classifies as anonymised data and no longer falls under the requirements of the UK GDPR.