2 ms·
> the GDPR only protects personally identifiable data Be very careful with this - the GDPR is not just about PII. It covers any data related to someone who cou
by spiffytech 5y ago
> the GDPR only protects personally identifiable data
Be very careful with this - the GDPR is not just about PII. It covers any data related to someone who could be identified directly (e.g., a name) or indirectly (several anonymous traits that realistically could only be one person).
Any data related to such a person is covered, even if that data itself isn't PII. The data they've uploaded, your logs of their system activity, the support tickets they've filed, it's all covered.
The wording in GDPR Article 4.1 is "‘personal data’ means any information relating to an identified or identifiable natural person ‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person"