# Personal data and GDPR

> Information about you, and the laws that say who can use it and how.

- Level: Basic
- Topics: Security
- URL: https://tidbit.legios.com.ar/personal-data-and-gdpr/
- In Spanish: [Datos personales y RGPD](https://tidbit.legios.com.ar/es/personal-data-and-gdpr/)

**Personal data** is any information that identifies a person or can be linked to one: a name, an email, a phone number, an ID number, a home address, but also a photo, a location history, an IP address or the record of what you bought. Some kinds are treated as especially sensitive, like health, religion, political views or biometric data such as fingerprints.

**Data protection laws** set the rules for organizations that collect and use that information. The best known is the European Union's **GDPR** (General Data Protection Regulation), in force since 2018. It says a company needs a valid reason to use your data (your consent, a contract, a legal duty), may use it only for the purpose it told you, should keep no more than it needs and must protect it. It gives you rights: to see what they hold about you, to correct it, to have it deleted, and to take it elsewhere. Companies must report serious data breaches quickly, and fines can be very large. It applies to anyone handling data of people in the EU, wherever the company is based.

Many other places have their own laws built on similar ideas. **Argentina** has had a personal data protection law since 2000, with a public agency that oversees it and receives complaints; Brazil has the LGPD, California the CCPA, and most of Latin America has something comparable. That is why sites ask about cookies, why apps show privacy policies and why you can ask a company what it knows about you. For engineers it means designing systems that collect less, encrypt more and can actually delete a person on request.

## An analogy

Your data is like a key to your house that you lend to a company. The law says they must tell you why they want it, use it only for that, keep it safe, and give it back when you ask.

## Keep in mind

- Personal data is anything that identifies you, directly or combined with other data.
- GDPR is the EU's law, in force since 2018, and it applies to anyone handling EU residents' data.
- Core rights: see, correct, delete and take your data elsewhere.
- Argentina and many other countries have their own data protection laws and authorities.

## Go deeper

- [Data protection in the EU (European Commission)](https://commission.europa.eu/law/law-topic/data-protection_en)
- [General Data Protection Regulation on Wikipedia](https://en.wikipedia.org/wiki/General_Data_Protection_Regulation)
- [Personal data in Argentina (AAIP, in Spanish)](https://www.argentina.gob.ar/aaip/datospersonales)

## Related terms

- [IP address](https://tidbit.legios.com.ar/ip-address/): The number that identifies a device on a network, like a postal address.
- [Biometrics](https://tidbit.legios.com.ar/biometrics/): Proving who you are with your body: a fingerprint, your face, your voice.
- [Data breach](https://tidbit.legios.com.ar/data-breach/): When private data an organization holds ends up with people who should not have it.
- [Cookies](https://tidbit.legios.com.ar/cookies/): Small notes a website asks your browser to keep, so it can recognize you later.
- [Encryption](https://tidbit.legios.com.ar/encryption/): Scrambling data so that only someone with the key can read it.