Protecting data – Personal data

When dealing with the topic of data protection, one inevitably deals with personal data, because the term data protection refers to the protection of personal data. Since 2018, the General Data Protection Regulation (GDPR) has governed the handling of personal data. Violations of the GDPR requirements can result in severe penalties, with fines of up to €20 million or up to 4% of the company's worldwide annual turnover of the previous year.
But what exactly is personal data and which types of information fall under this definition?

What is personal data?

The General Data Protection Regulation (GDPR) specifically requires the protection of personal data. But what exactly is personal data?

Personal data is any information relating to an identified or identifiable natural person. This includes all individual details concerning the personal or factual circumstances of a person. Examples include:

Name
Age
Address
Marital status
Height and weight
Telephone number
Email address
Vehicle registration number

Health data
Evaluative judgments such as certificates or references
Bank account number
Personnel number
Racial and ethnic origin
Political opinions
Religious or philosophical beliefs
Trade union membership

Personal data is therefore, above all, sensitive information that must be given special protection under data protection regulations.

Which data is particularly worthy of protection?

According to the General Data Protection Regulation (GDPR), which has been in force since May 2018, personal data is particularly worthy of protection. This means that the protection of the collected data must be ensured at all times. It must also be guaranteed that no unauthorized third party or external person can access or view this data at any point in time. As a result, special requirements apply to the destruction of personal data, since simply disposing of or throwing away documents is not sufficient to protect sensitive data from unauthorized access and inspection.

When is a person identifiable?

According to the General Data Protection Regulation (GDPR), a natural person is considered identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more characteristics specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

It is essential to prevent unauthorized persons from identifying an individual on the basis of such data and to ensure that this sensitive information is adequately protected. Article 4(5) GDPR regulates the pseudonymization of data.

If you would like to learn more about GDPR-compliant document shredders, visit our website or contact us directly. Our experts will be happy to advise you.

How is data processed and stored securely?

When processing and handling personal data, certain principles must be followed. Processing may only be carried out lawfully, for a specific purpose, and in a factually correct manner. The provisions of the General Data Protection Regulation (GDPR) also apply here. These requirements apply to both companies and private individuals.

Documents containing personal data must not simply be left unattended, as they could then be read by unauthorized persons such as postal workers, cleaning staff, or even housemates when working from a home office.

Only the personal data that is necessary to fulfill the intended purpose may be used, processed, and stored. As soon as the purpose of the processing has been fulfilled, the data must be deleted.

How do I destroy personal data?

It is often assumed that it is sufficient to dispose of paper files containing personal data in the regular waste. What is frequently overlooked is that the party processing the data is also responsible for ensuring that this data is destroyed securely and does not fall into the hands of third parties.

The safest way to destroy personal data is by using a document shredder. Depending on the type of document, it must be determined which protection class and security level (link to protection classes page) the document shredder must meet. Document retention periods (link to landing page) must also be taken into account when making this decision.

If personal data is not stored on paper but on hard drives, USB flash drives, or SD cards, destruction is also recommended. This is the only way to ensure that the information is no longer accessible to third parties. Special devices such as media shredders are available for this purpose. These can be used directly on site and therefore ensure optimum data security.