4.1Understanding the GDPR & personal data
The essentials in 30 seconds
- Anything that identifies is data: name, email, phone, IP address, photo — directly or by cross-referencing.
- Every file is a processing activity: even the small local client spreadsheet is subject to the rules.
- 5 principles + 1 reflex: purpose, minimisation, limited retention, security, information — and identify your DPO before you need them.
Running mini-case — Karim inventories his files
Karim, an office employee in Algiers, thought data protection was the IT department's business. By listing his 5 daily tools, he discovers three files full of personal data: his client spreadsheet, a folder of job applications and an HR tracking table. For each one he notes the purpose, the age and who has access, then asks for his company's data contact. He has just inventoried his first 'processing activities' without knowing it.
This same case returns in the lesson, the diagram, the script and the 48h challenge — and continues in 4.2, 4.3 and 4.4.
1. A regulation that applies to everyone
The GDPR (in force since 2018) governs any collection and processing of personal data. It applies to any organisation, even a small one, as soon as it handles customer, employee or prospect data — Karim's file just like a multinational's database.
In case of a breach, fines can reach very high amounts (up to 4% of worldwide turnover under the European framework): compliance is not a decorative option.
2. Data, processing, sensitive data
Personal data = anything that identifies someone (name, email, IP address, photo, voice…). Processing = any operation on it: collecting, storing, viewing, transmitting, deleting. Karim's client spreadsheet IS a processing activity.
Sensitive data (health, opinions, religion, trade union membership, biometrics…) follows strengthened rules: processing it is prohibited in principle except under strict exceptions. An HR table containing sick leave therefore deserves special vigilance.
3. The cardinal principles and the DPO
Purpose defined (why this data?), minimisation (do we need this much?), retention period limited (since when?), security (who has access?), information of individuals: five questions Karim now asks about each of his files.
The DPO (data protection officer) or data contact advises and monitors: they are your point of contact for any question. Identify them before you need them, not on the day of an incident.
🔎 Concrete example — 🔎 Concrete example — Spotting the data around you
Karim's inventory, done in twenty minutes on his real tools:
Client spreadsheet (names, phones) → commercial processing, who has access?
Applications folder (CVs, emails) → since when? purge when?
HR tracking table (absences, health reasons?) → sensitive data: heightened vigilance
Questions asked: why? how much? since when? who?
→ data contact saved in his favouritesReading: three ordinary files, three processing activities to frame.
Lesson: every personal data file is a 'processing activity'.
Section vocabulary
- GDPR
- The European regulation (2018) governing all personal data processing, with fines that can reach a high percentage of worldwide turnover.
Simple example: Karim's client spreadsheet, like any database, must respect purpose, minimisation and limited retention.
What it is not: a rule reserved for large companies or the legal department alone.
Reflex: ask each file: what purpose, and is my contact identified?
- Personal data
- Any information relating to an identifiable person: name, email, phone, IP address, photo, number plate, voice…
Simple example: In Karim's file, 'firstname.lastname@company.com' identifies someone; a generic department address does not.
What it is not: only the password or bank details.
Reflex: test identifiability: can I link this to someone?
- Sensitive data
- Strengthened categories (health, opinions, religion, trade union membership, biometrics…) whose processing is prohibited in principle except under strict exceptions.
Simple example: Karim spots health reasons in his HR table: restrict access as a priority.
What it is not: ordinary data such as a name or a professional email.
Reflex: isolate and flag any sensitive data encountered by chance.
- Processing
- Any operation on data: collecting, storing, viewing, transmitting, deleting.
Simple example: Karim's client spreadsheet IS a processing activity, just like a large database.
What it is not: an internal document free of any rules because it is small or local.
Reflex: count your processing activities: one personal data file = one processing activity.
- Controller / DPO
- The organisation decides on processing (controller); the data protection officer advises and monitors — your point of contact for any question.
Simple example: Karim notes the name and contact of his data contact before he needs them.
What it is not: a colleague to whom you improvise legal answers instead.
Reflex: keep the DPO contact in your favourites, like the IT one.
In practice — In practice — Spot the personal data around you
- List 5 files/tools you use: which ones contain personal data (clients, colleagues, candidates)? You have just inventoried 'processing activities'.
- For one of them, ask the basic questions: why this data (purpose)? do you need this much (minimisation)? since when (retention)? who has access?
- Spot any sensitive data (health in an HR file?): its processing follows strengthened rules.
- Identify your DPO or data contact: name and contact — they settle the questions.
Ready-to-say script — introducing yourself to the data contact (30 s)
'Hello, this is Karim: I handle a client file and an HR table every day. I wanted to know the rules to follow (purpose, retention, sharing) and who to turn to if in doubt. Can you confirm the procedure?'
Say it before any problem; note the answer and keep the contact at hand.
Copy-paste template — processing inventory sheet
FILE / TOOL: _______________
DATA HELD (personal? sensitive?): _______________
PURPOSE (why?): _______________
MINIMISATION (is everything useful?): _______________
AGE / RETENTION: _______________
WHO HAS ACCESS: _______________
CONTACT CONTACTED ON: _______________Small team with no DPO
Still identify a contact (manager, supervisor): the absence of a DPO does not suspend the principles.
Sensitive HR file
Restrict access as a priority and flag it to the contact: health and absence reasons are strengthened data.
Working from home
Check where local copies are stored (downloads, desktop): processing does not stop at the office walls.
New joiner
Redo the 5-tool inventory in the first week: you often inherit files whose content you do not know.
✓ Best practices
- Each personal data file = a processing activity.
- Purpose, minimisation, retention, security.
- DPO identified before you need them.
✗ Common pitfalls
- Reserved for large organisations.
- The HR file forgotten from the rules.
- Collecting 'just in case' with no purpose.
Key takeaways
- Personal data = anything that identifies someone, directly or by cross-referencing.
- Each file holding such data is a processing activity subject to the rules — including the small local spreadsheet.
- Cardinal principles: defined purpose, minimisation, limited retention, security, informing individuals.
- The DPO/contact is your point of contact: identify them before you need them.
48h challenge — apply tomorrow
Fill in the inventory sheet for 1 real file (clients, HR or applications) and save your contact's details in your favourites.
- I can define personal data, processing and sensitive data.
- I can cite the 5 cardinal principles.
- I have inventoried 1 real file and noted my contact.
Frequently asked questions
Does the regulation cover my colleagues' data or only clients'?
Both: employees, candidates, contractors, clients, prospects — any natural person. The HR file is even one of the company's most sensitive processing activities.
Is a generic professional email address personal data?
A non-nominative department address, no; a firstname.lastname address, yes (identifiable person). The criterion is always whether the person is identifiable.
Karim's client spreadsheet, under the rules, is…