A few key terms come up throughout data protection. Knowing them makes everything else easier.

Personal data is any information relating to an identified or identifiable person, such as a name, an email address, an identification number, or location data.

Special category data is more sensitive and needs extra protection. It includes health, ethnicity, religious or philosophical beliefs, trade union membership, genetic and biometric data, and data about a person’s sex life or sexual orientation.

Processing means almost anything you do with data, from collecting and storing to using, sharing and deleting.

A data controller decides why and how personal data is processed. A data processor acts on the controller’s instructions.

Real-life example

Imagine an HR administrator opens a spreadsheet of staff records to update one address. The names and addresses are personal data; any sickness notes in the same file are special category data and need extra care. The company is the controller, and a payroll provider it sends the file to is a processor.