Data Privacy Awareness

Recognising personal data

Personal data is wider than most people expect. Examples:

• Names, email addresses, phone numbers and postal addresses
• Identification, customer or employee numbers
• Location data, IP addresses and online identifiers
• Photos, voice recordings and biometric data
• Anything that can identify someone when combined with other data

Some categories are more sensitive and carry stricter rules, such as health data, religion, political opinions, sexual orientation and biometric data used for identification. The glossary term PII (personally identifiable information) is the common shorthand, though legal definitions vary by country.

What this means in code

• Collect only what you need. Data you never store cannot leak.
• Find out where personal data lives. Databases, logs, backups, analytics tools, exports and test data can all contain it.
• Keep it out of logs and error messages. See Logging Fundamentals.
• Do not copy production data to development. Use anonymised or synthetic data (see Test Data Management).
• Protect it with access control, encryption in transit and at rest, and properly handled secrets.
• Plan for deletion and access requests. People may have rights to see, correct or erase their data, and the system should make that possible.
• Sending personal data to an external service, including AI tools, is a disclosure that may need approval.

Who to involve

Most organisations have a Data Privacy Officer (sometimes called a Data Protection Officer, DPO) or another privacy contact. Involve them early: when you plan a feature that collects new kinds of personal data, adds a new vendor, moves data to another country or reuses data for a new purpose. This topic is awareness only. Legal decisions are not yours to make alone, but noticing the issue and asking is your job.

Try it

Take a small application you know and list the personal data it collects. Check the sign-up form, the database tables and the logs. For each item, note why it is needed and who can access it, and mark anything you cannot justify.