What is personal data?

Under UK GDPR, personal data is defined as:

any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular in reference to an identifier such as name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Personal data includes: name, date of birth, National Insurance number, home address, email address, student ID number, dates of enrolment, attendance information, visa and immigration information, student or staff photo, disciplinary information, bank and financial details, exam and assessment results.

Special category data is a subset of personal data that requires even more protection. It includes data relating to:

racial or ethnic origin;
political opinions;
religious or philosophical beliefs;
trade union-membership;
health;
sex life and sexual orientation;
genetics;
biometrics.

Examples of special category data includes: open door and disability support records, sick notes and medical fit notes, equality data and trade union membership status.

Criminal offence and conviction data is afforded even more protection under UK GDPR. Before gathering this data, please contact dataprotection@york.ac.uk for advice.