The definition of personal data for the purposes of the Data Protection Act 1998 is contained in Section 1 of the Act. Personal data is that which relates to a living individual who can be identified from the data, or from the data and other information which is in the possession of, or likely to come into the possession of, the data controller.
Personal data includes opinions expressed about the person and also any indication of intention, expressed by the data controller or any other person, towards the individual concerned.
Whether data is covered by the Data Protection Act as personal data depends therefore on both the nature of the data and the use to which it is, or could be, put. Clearly, the definition is capable of including a wide variety of data about a person. The leading British case on what is and what is not personal data implies a rather narrow interpretation, but a recent EU opinion implies that the definition should be interpreted quite widely.
The office of the Information Commissioner has issued a guidance note on what constitutes personal data. This includes a helpful flowchart and can be found at
If you require guidance on whether information is personal data or on the management of personal data which you hold, we can advise you.
Partner Note
The guidance on what constitutes personal data can be found at
Durrant v Financial Services Authority [2003] EWCA Civ 1746.
Determining What is Personal Data – Opinion 4/2007 of the EU Article 29 Working Party – June 2007.