Definition of personal data

The Act defines personal data as: “any information relating to an identified or identifiable individual.”

An identifiable individual is one who can be identified, directly or indirectly, particularly by reference to:

• a name
• an identification number
• location data
• an online identifier
• one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that individual.

Definition of sensitive personal data

The Act further recognises special categories of personal data, which are afforded enhanced protection due to the sensitive nature of the information and the potential impact of misuse on the rights and freedoms of individuals.

These categories include personal data revealing:

• racial or ethnic origin
• political opinions
• religious or philosophical beliefs
• trade union membership
• genetic data
• biometric data used for identification
• health data
• data concerning a person’s sex life or sexual orientation.

Responsibility of organisations

While the Information Commission exercises regulatory oversight, the primary responsibility for ensuring the protection of personal data rests with organisations that process personal data, namely:

• Data Controllers – entities that determine the purposes and means of processing personal data.
• Data Processors – entities that process personal data on behalf of a controller.

Such entities are required to comply with the data protection principles and other obligations established under the Act.

Appointment of controllers, processors and other roles

The Act recognises functional roles within the data protection framework rather than requiring formal appointment or designation of such roles, except where the appointment of a Data Protection Officer (DPO) is required.

Under the Act, organisations are not required to formally appoint a data controller or data processor. These roles arise automatically depending on the function performed by the entity in relation to the processing of personal data.

• Data Controller: A data controller is defined as the person or entity that determines the purposes and means of processing personal data.
• Data Processor: A data processor is a person or organisation that processes personal data on behalf of the controller.