Categories of Personal Data Training

What the training consists of

1. 

   1. Non-sensitive personal data

   2:49

   Non-sensitive personal data, often simply called personal data, ranges from a name to a CV. The first lesson explains what makes each example personal data, since each one can identify a person, contact or locate them, or track what they do.

2. 

   2. Sensitive personal data

   2:57

   Sensitive personal data (special categories of personal data) covers types of information that have been, or still are, grounds for discrimination. The second lesson goes through each type, from racial or ethnic origin and political opinions to health and sex life.

3. 

   3. Children, criminal offences and confidential information

   1:29

   The last lesson covers three more kinds of data to recognise at work: personal data about children under 16, data about criminal offences, and confidential data such as login credentials, which the GDPR does not explicitly mention but which still calls for extra care.

Why it matters

Under the GDPR, sensitive personal data comes with special restrictions, and special rules govern who may process data about criminal offences. An organisation can only respect them if the people who handle personal data recognise these kinds of data when they meet them in their work.

What your colleagues learn

• Separate pieces of data add up to a person’s identity. A profile picture can identify someone on its own, and alongside a name and contact details it gives a much fuller view of who that person is.
• A CV or a holiday request can hold sensitive data. Political opinions may appear in a job applicant’s CV, and religious beliefs may come up when HR accommodates religious holidays or dietary restrictions.
• Only trained staff should process sensitive data. Anyone who comes across it in their work should wait until they have been trained on the organisation’s own policy for this data.
• Children’s data needs special protection. Children might not fully understand the risks when their data is collected, so their safety should be considered from the beginning, when systems and processes are designed.
• Data about criminal offences covers more than crimes committed. A home address that is a prison counts too, and an HR background check on a job candidate can bring such data into an ordinary company.