Background knowledge

personal

related

Data.

Personal data

In the digital age, personal data is becoming increasingly important – both for companies and for private users. Under data protection law, personal data is any information relating to an identified or identifiable natural person. This term is the central pivotal point in data protection law.

What is personal data?

According to the GDPR, the term personal data includes all information relating to an identified or identifiable natural person. This includes, for example

Surname, first name and date of birth:
Classic identification features that enable direct assignment to a person.
Address and contact details:
Postal address, telephone number and e-mail address.
Online identifiers:
IP addresses, cookie IDs and other digital identifiers that can be assigned to a person on the Internet.
Special categories:
Data concerning racial and ethnic origin, political opinions, religious beliefs, health data or biometric data, insofar as these are used for identification purposes.

This broad definition shows how diverse personal data can be – and why protecting it is important for companies and consumers alike.

Anonymization and pseudonymization

Companies and organizations are often faced with the challenge of making personal data usable for analysis or archiving purposes without violating data protection regulations. Two central procedures can help to remove the direct personal reference:

Anonymization

During anonymization, all personal characteristics are removed or changed in such a way that a personal reference can no longer be established. The aim is to transform data in such a way that the data subject is no longer identifiable – and therefore the GDPR no longer applies.
Examples of anonymization procedures include

Data masking:
Remove or replace key information such as names or addresses.
Aggregation:
Aggregation of individual pieces of information into larger data sets so that no conclusions can be drawn about individuals.

Pseudonymization

In contrast to anonymization, pseudonymization removes the personal reference, but it can be restored using a key. Here, direct identifiers are replaced by pseudonyms (e.g. consecutive numbers or codes). This method reduces the risk of identification, but under certain circumstances allows the data to be traced back to the original person – for example, to update or supplement data if necessary.

Both methods play an important role in data protection, whereby anonymization is regarded as a final and irreversible protection mechanism, while pseudonymization is often used as an intermediate step in data processing.