The two main elements of personal data are that the information must ‘relate’ to a living person and the person must be identifiable.
Information will relate to a person if it is about them, linked to them, has some biographical significance for them, is used to inform decisions affecting them or has them as its main focus.
Therefore the definition of personal data is far wider than mere names and contact details.
With this in mind please take extra care that an individual’s personal data is not accidentally disclosed because they can be identified from information we hold about them. A good example of this is when someone tells us about something where further action may be required. If it is possible to identify them from the information given (e.g. they may give very specific details about where they live), then it is a good idea to stop and think about what you do with that data to ensure that any further processing is “fair” and “secure” in line with the UK GDPR and Data Protection Principles.
If you have any concerns please contact Kate Butcher (Deputy Data Protection Officer) who will be happy to discuss.