3.1Understanding the GDPR & personal data
The essentials in 30 seconds
- Personal data = a very broad concept: any information about an identified or identifiable person (name, email, IP, photo…); sensitive data enjoys stronger protection.
- Every processing activity requires a LEGAL BASIS and a specific PURPOSE; principles: minimisation, limited retention, security, transparency.
- Accountability: comply AND be able to prove it; distinguish the controller (who decides) from the processor (who carries out).
Running mini-case — Yacine discovers that 'everything is data'
Yacine, who runs a small services business in Algiers, stores his customers' names, phone numbers and emails in a shared spreadsheet, with no rules. As he prepares his compliance effort, he lists his files (customers, prospects, employees) and discovers that almost everything is personal data. For each use he notes a specific purpose and a legal basis — and stops collecting 'just in case'.
This same case runs through the lesson, the diagram, the script and the 48h challenge — and continues in 3.2, 3.3, 3.4 and 3.5.
1. Personal data
The GDPR (General Data Protection Regulation) is the EU reference text, with global influence: it applies as soon as you process data of people located in the EU. Many countries have their own law, similar in spirit.
Personal data: any information relating to an identified or identifiable natural person (name, email, IP, photo…). Some data is sensitive (health, opinions…) and enjoys stronger protection.
2. The key principles
To be understood rather than memorised: lawfulness (a legal basis: consent, contract, obligation, legitimate interest), purpose (a specific aim), minimisation (only what is necessary), accuracy, limited retention, security, transparency.
Plus accountability (being able to demonstrate compliance). Distinguish the controller (who decides) from the processor (who carries out).
3. The starting reflex
Assume that most of your files contain personal data: map them, then set a purpose and a legal basis for each processing activity.
Check your country's law (and the GDPR if EU data is involved) before acting: this is the foundation for sections 3.2 to 3.5.
🔎 Concrete example — 🔎 Practical example — A very broad concept
'It is almost everything.'
Customers, prospects, employees, users, supplier contacts…
Name, email, IP, photo, customer ID, video recording.
→ as soon as information can identify someone, it is personal data.Result: you grasp the scope of the field and the principles.
Reflex: check the law of your country (and the GDPR if EU data is involved).
Section vocabulary
- Personal data
- Any information relating to an identified or identifiable natural person (name, email, IP, photo, ID…).
Simple example: The customer names, phones and emails in Yacine's spreadsheet.
What it is not: aggregated, anonymous business figures.
Reflex: ask 'can it identify someone?'.
- Sensitive data
- A special category (health, opinions, origin, biometrics…) enjoying stronger protection.
Simple example: An employee health record kept by Yacine.
What it is not: a simple business contact email.
Reflex: spot sensitive data and handle it separately.
- Legal basis
- The ground authorising a processing activity (consent, contract, legal obligation, legitimate interest…); without one, no lawful processing.
Simple example: Yacine relies on contract for his customers, consent for the newsletter.
What it is not: processing data 'because you feel like it'.
Reflex: for each processing activity: one purpose + one basis.
- Controller vs processor
- The controller decides purposes and means (the business); the processor acts on its behalf (provider, software).
Simple example: Yacine decides; his host and payroll software carry out.
What it is not: believing the provider decides instead of the business.
Reflex: who decides? who carries out? each has its duties.
- Accountability
- The duty not only to comply with the rules but to be able to PROVE it (documentation, register).
Simple example: Yacine keeps track of his purposes, bases and retention periods.
What it is not: saying 'we comply' with no document at all.
Reflex: what is not documented cannot be demonstrated.
In practice — In practice — Laying the foundations for data compliance
- List the personal data you process (customers, prospects, employees, users) and spot sensitive data.
- For each processing activity, identify its specific PURPOSE and its LEGAL BASIS (consent, contract, obligation, legitimate interest).
- Apply minimisation (collect only what is necessary) and set retention periods; secure the data.
- Inform people clearly and check the legislation in your country (and the GDPR if you process EU data).
Ready-to-say script — setting the collection rule with the team (1 min)
'From today, we only collect data when we know why and on what basis: purpose, legal basis, retention period. No more 'just in case'. Let's make the list together this week.'
Say it to the team: set the purpose + basis rule before any new collection.
Copy-paste template — starter processing sheet
PROCESSING: _______________ (e.g. customer file)
DATA: _______________ | PEOPLE: _______________
SPECIFIC PURPOSE: _______________
LEGAL BASIS: _______________ (consent / contract / obligation / legitimate interest)
RETENTION: _______________ | SECURITY: _______________VSE / small budget
A spreadsheet is enough: one row per processing activity (data, purpose, basis, retention) reviewed each quarter — no costly tool needed to start.
SME in Algiers
Yacine lists his files in Algiers: customers, prospects, payroll — and checks with his local contact which Law 18-07 rules apply to each activity.
Showcase site + prospects
Contact form: ask only for the strict minimum (name, email, message) and state the purpose under the form.
Multiple providers
List who processes for you (host, software, accountant): you remain the controller even when the processor carries out.
✓ Best practices
- Assume most of your files contain personal data.
- For each processing activity: a specific purpose and a legal basis.
- Minimise, secure, inform, and check your country's law.
✗ Common pitfalls
- Processing data 'because you feel like it' (with no legal basis).
- Collecting 'just in case' (against minimisation).
- Believing that being far from Europe removes all obligations.
Key takeaways
- Personal data = any information about an identifiable person (very broad: name, email, IP, photo…); sensitive data has stronger protection.
- All processing requires a LEGAL BASIS and a specific PURPOSE; principles: minimisation, accuracy, limited retention, security, transparency.
- Accountability: comply AND be able to prove it (documentation). Distinguish the controller (decides) from the processor (carries out).
- The GDPR has global reach (EU data); many countries have their own similar law — check your country's rules and authority.
48h challenge — apply it tomorrow
List 3 real processing activities (customers, prospects, employees) with purpose + legal basis for each, and delete 1 data item collected 'just in case'.
- I can define personal data without hesitating.
- I can cite legal basis + purpose for 3 processing activities.
- I deleted 1 unnecessary collection this week.
Frequently asked questions
Does the GDPR apply to me if my business is not in Europe?
Maybe: the GDPR has extraterritorial reach — what matters is processing data of people located in the EU (goods/services, monitoring), not your headquarters. But beyond the GDPR, most countries have their own legislation, often inspired by the same principles: you are very likely subject to your country's law. Think on two levels: (1) my country's law first; (2) the GDPR if you process EU data. If you operate internationally, get advice.
In practice, which of my business data is covered?
Your feeling is largely right: the concept is deliberately very broad — customers, prospects, employees and applicants, supplier contacts, users (accounts, IPs, cookies). Truly anonymous data falls outside (but real anonymisation is hard) and data about legal entities is not personal (though their contacts are). The first step is mapping: which data, why, where, who accesses it, how long, to whom — this prepares the register in section 3.2.
What does any processing of personal data require?