Personal data and GDPR

Personal data is any information that identifies a person or can be linked to one: a name, an email, a phone number, an ID number, a home address, but also a photo, a location history, an IP address or the record of what you bought. Some kinds are treated as especially sensitive, like health, religion, political views or biometric data such as fingerprints.

Data protection laws set the rules for organizations that collect and use that information. The best known is the European Union's GDPR (General Data Protection Regulation), in force since 2018. It says a company needs a valid reason to use your data (your consent, a contract, a legal duty), may use it only for the purpose it told you, should keep no more than it needs and must protect it. It gives you rights: to see what they hold about you, to correct it, to have it deleted, and to take it elsewhere. Companies must report serious data breaches quickly, and fines can be very large. It applies to anyone handling data of people in the EU, wherever the company is based.

Many other places have their own laws built on similar ideas. Argentina has had a personal data protection law since 2000, with a public agency that oversees it and receives complaints; Brazil has the LGPD, California the CCPA, and most of Latin America has something comparable. That is why sites ask about cookies, why apps show privacy policies and why you can ask a company what it knows about you. For engineers it means designing systems that collect less, encrypt more and can actually delete a person on request.