Personal data

Personal data is any information related to an identified or identifiable natural person. The definition sits in most privacy laws (in Brazil, article 5 of the LGPD), and the decisive word is the second one: it does not need to state a name. If the data can lead to someone — alone or cross-referenced with other data — it is personal data.

What is on the list

Name, national ID, email, phone, address, photo, license plate, IP address, device identifier, location, purchase history, a voice recording. A WhatsApp number is personal data, and a list of numbers with no other information still is one — because it identifies.

Sensitive data is a separate category

Privacy law sets apart a class with reinforced protection: racial or ethnic origin, religious belief, political opinion, union or religious/philosophical/political affiliation, health or sex-life data, and genetic or biometric data. Handling these requires a specific legal basis — as a rule, explicit consent — and mishandling weighs more heavily.

In practice, in support work: a clinic that notes the procedure in the chat, a church that segments its base by attendance, and a gym that stores a medical report are all handling sensitive data, even if they think it is "just a label."

What is not personal data

Data belonging to a legal entity (a company's tax ID, a front-desk phone number) and anonymized data, as long as the anonymization is irreversible. Replacing a name with a code anonymizes nothing: if there is a table that maps back to the name, the data is still personal. It also does not count as anonymous when a slice is so specific that only one person fits it.

A WhatsApp inbox is a personal-data database

A support operation accumulates, without realizing it, thousands of names, phone numbers, delivery addresses, receipts, ID photos and audio messages. Three questions resolve most of the compliance work: why each piece of data was collected, who inside the business can see it, and for how long it is kept. An agent who exports the base to their personal phone when resigning is the most common incident, and the least monitored.