Personal data: there's more than you think!

While the RGPD has been around for over 5 years, I'm surprised to still hear some people believe that personal data is limited to a few things like name and address, when the definition of personal data is much broader than they think.

" Any information relating to an identified or identifiable natural person (hereinafter referred to as the "data subject; an "identifiable natural person" is deemed to be a natural person who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity."

This definition is very broad, and it's important to understand that a great deal of data is personal data.

Since personal data is any element that identifies a person, there are obviously a large number of them:

• Car plate number
• Cell phone number
• Social security number
• Postal address
• Email address
• IP address (address of your connected device)
• Identity card or passport number
• Sports club membership number
• Individual photo
• Group photo
• Photo of a house
• Aerial photo of a house
• Postal address
• Voice recording
• Bank statements
• payslip
• Etc.

A person can also be identified by the combination of several elements, seemingly unrelated to a person, such as the fact that a person lives in a particular village, is a school teacher and a local councillor in the village in question.

It is important to note that personal data does not necessarily have to enable a person to be identified immediately. If a surname and first name allow it, the number of a car license plate, although not allowing immediate identification of the person concerned, is nevertheless personal data, as it will allow indirect identification of the person concerned.

It's just another myth!

While the contact details of companies and organizations are not personal data, and are therefore not subject to the RGPD, companies that bear the name of their owner (Boucherie Jean Dupont, for example) are therefore indeed personal data

As for professional e-mail addresses, while info@société.com is not personal data when used by several people, an e-mail address such as prénom.nom@société.com is obviously personal data.

Another unfounded preconception. In fact, even if 100% of your customers and prospects are companies, you obviously have the surnames, first names, mobile numbers etc. of natural persons, and all this constitutes personal data.

So even companies that only work in B2B are subject to the RGPD!