It can be any information that relates to the identity of a person. This information can be direct or indirect or it can be a collection of data which leads to the identification of a specific person. All factors in the data should lead to the identification of an individual to constitute to be personal data.

Technology these days generate a great amount of data about any individual through online transactions like credit card payments or account opening, and a business will need the consent to collect, use or disclose personal data.

Where personal data is anonymised, encrypted, de-identified, pseudonymised or hidden in any way but a person can still be identified, it is still considered personal data. However, if the personal data has been anonymised such that the anonymisation is irreversible and the individual is no longer identifiable, such data is no longer personal data.