Personal data
By Gareth HoyleLast updated How we research
Personal data, called personal information in most US laws, is information that identifies, relates to or could reasonably be linked to a particular person or household.
Personal data is information that identifies, relates to or could reasonably be linked to a particular person. Most US laws call it personal information. The CCPA, at California Civil Code section 1798.140(v), covers information that could reasonably be linked, directly or indirectly, with a particular consumer or household, and excludes publicly available, deidentified and aggregate information.
Since January 1, 2023 the CCPA has also covered California employees, job applicants and business contacts, according to the California Privacy Protection Agency. The US has no single federal definition, and sector laws such as HIPAA for health records and GLBA for financial institutions add their own.
What is sensitive personal information?
Sensitive personal information under CCPA section 1798.140(ae) includes Social Security numbers, account log-ins, precise geolocation, the contents of mail, email and text messages unless the business is the intended recipient, genetic data, biometric information processed to identify someone and health information. Company archives hold much of it: email bodies, support tickets and call recordings.
If you hold UK data, the ICO applies the UK GDPR definition in Article 4(1), which covers information relating to an identified or identifiable living individual.
Our seller vetting excludes personal data unless the privacy notice in force at collection and the law allow the disclosure, or the data is properly de-identified. See can you legally sell company data for AI.