Understanding personal data
Personal data is information that can be linked to a person, directly or indirectly. This guide helps you review privacy findings before using, retaining, or sharing a text.
In brief
A finding does not automatically mean that the text is unlawful or must be deleted. Consider whether the information is necessary, whether the recipient should receive it, and whether it can be limited, anonymised, or removed.
What counts as personal data?
Direct identification
A name, email address, telephone number, image, national identifier, or employee number can identify a person directly.
Indirect identification
A role, workplace, location, age, voice, or detailed event can identify someone when combined with other information.
Sensitive and high-risk information
Take particular care with:
- health information
- racial or ethnic origin
- political opinions
- religion or philosophical beliefs
- trade-union membership
- genetic data
- biometric data used for identification
- sex life or sexual orientation
National identifiers, financial information, passwords, criminal matters, whistleblowing, personnel cases, conflicts, and information about children can also create high risk and require strict handling.
Five questions before using the text
- Is the information necessary for the document’s purpose?
- Do the recipients need it and have the correct access?
- Is it accurate? Transcription and AI can be wrong.
- Can it be limited by using a role, anonymisation, or redaction?
- Do sharing and retention follow the organisation’s rules?
What skrivDET findings mean
The privacy check is decision support. It can flag information that is not actually personal data and can miss information that should have been found. Review the full context yourself before approving or sharing a document.
This is general guidance and does not replace legal advice or your organisation’s own procedures.