What is personal data?

Under UK GDPR, personal data is defined as:

any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular in reference to an identifier such as name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Personal data can include: name, date of birth, postal address, email address, phone number, student ID number, dates of enrolment or employment, attendance information, right to work or study information, student or staff photos, bank and financial details, exam and assessment results.

Special category data is a subset of personal data that requires more protection due to its sensitivity. It includes data relating to:

racial or ethnic origin;
political opinions;
religious or philosophical beliefs;
trade union-membership;
health;
sex life and sexual orientation;
genetics;
Biometrics (where used for identification purposes).

Examples of special category data can include: counselling and disability support records, sickness or occupational health records, equality and diversity data and trade union membership status.

Criminal offence and conviction data (including allegations) is afforded even more protection under UK GDPR. Before gathering this data, please contact dataprotection@york.ac.uk for advice.