The different types of personal data unraveled

Not all personal data is created equal. The GDPR distinguishes between ordinary personal data, special personal data, and criminal data — and in practice, there is also talk of “sensitive” data such as BSNs, location data, and financial data. The more sensitive the data, the stricter the rules for processing and security. Knowing which category your data falls into determines which legal basis you need and which measures you must take. Below is an overview of the types.

What is personal data?

Personal data is any data that can be traced back to an individual, directly or indirectly. Almost every company processes it—think of customer, employee, and supplier data. If data can no longer be traced back to a person, for example after proper anonymization, then it is no longer personal data and the GDPR does not apply to it.

Ordinary personal data

The most common category. This consists of data that directly or indirectly refers to an individual, such as name, address, email address, and telephone number. They form the basis of your daily interactions with customers and business relations. You also need a valid legal basis for ordinary personal data, but the requirements are less strict than for the more sensitive categories.

Special personal data

Special categories of personal data are highly sensitive and enjoy extra protection. This concerns data about:

• race or ethnic origin;
• political views;
• religious or philosophical beliefs;
• health and sexual life;
• membership of a trade union;
• genetic and biometric data (for unique identification).

The processing of special categories of personal data is prohibited in principle, unless a statutory exception applies — explicit consent from the data subject is often required.

Sensitive personal data

In addition, there is sensitive personal data that has a greater impact on privacy than ordinary data, such as location data, financial data, and the BSN. They are not explicitly mentioned as a separate category in the law, but they do require extra care. The BSN, for example, may only be used if permitted by law.

Criminal data

Data concerning criminal convictions and offenses constitute a separate category subject to even stricter protection. Processing such data is only permitted under certain, limited circumstances and often under government supervision or on the basis of a specific legal ground. This data certainly may not simply be passed on, let alone sold.

Why is the distinction so important?

The category determines:

• which basis you need and which conditions you must meet;
• which security measures are appropriate — the more sensitive, the more stringent;
• whether processing is permitted at all.

Anyone who mixes the species risks unlawful processing and, consequently, fines and reputational damage.

Frequently asked questions about types of personal data

Is an email address personal data?

Yes, if it can be traced back to an individual (such as [email protected]). Even a generic-looking address can be personal data if, when combined with other data, it leads to someone. Therefore, treat email addresses as personal data.

Am I allowed to process special personal data of my staff?

Only within the strict exceptions. For example, you may only process employees' health data to a very limited extent; much absence information is handled by the company doctor. Document which data you truly need and on what legal basis.

When is data truly anonymous?

Only when they can no longer be traced back to a person in any reasonable way — not even by combination with other data. Encrypted or pseudonymized data are still personal data. True anonymization is more difficult than often thought.

Questions about the data you process?

Are you unsure which category your data falls into or which rules apply? The legal experts at MKB Juristen map out your processing activities and advise on the legal basis, security, and the appropriate documentation. View our expertise in privacy and data protection or schedule a no-obligation intake.