Personal data

What it means

Personal data is any information about an identified or identifiable natural person: name, address, birth number, email, phone, IP address, account number, photograph or camera footage. What matters is whether the person can be identified from the data directly or in combination with other information.

Processing is governed by the GDPR and the Slovak Personal Data Protection Act. Every processing operation needs a lawful basis, a specific purpose and a proportionate scope. Compliance is the responsibility of the controller, the party that determines purposes and means.

Data about companies as such, like the company ID or registered office, are not personal data. A specific employee's work email or a sole trader's contact details, however, are. A stricter regime applies to special categories such as health data.

How it works in practice

An ordinary company processes the personal data of employees, customers, suppliers and job applicants. For each purpose it should know what it collects, why, how long it keeps it and who receives it. The record of processing activities and the privacy notice give that overview.

Accounting is a typical example of processing based on a legal obligation. Invoices and payroll records contain personal data and must be kept for the statutory period; no consent is needed, nor could it be withdrawn. An external accountant acts as a processor.

Where the purpose does not require identifying people, data should be anonymised or at least pseudonymised. Truly anonymous statistics fall outside the GDPR. A person who suspects a breach of the rules can turn to the Office for Personal Data Protection.

What to watch out for

Many firms underestimate seemingly technical data. An IP address, a cookie identifier or location from a mobile app can be personal data if it can be linked to a specific person, and it is then subject to the same rules as a name and address.

Data subjects have rights of access, rectification, erasure and objection, and the company must normally respond within a month. Without an internal procedure saying who handles requests and where all the data sit, the deadline is easily missed and a complaint to the authority follows.