As a company you are responsible for the personal information of your customers and employees. You are legally required to protect the data and ensure that it is used correctly. It is not always clear what constitutes personal data.
It is important to note that the definition of personal data is different depending on the country and http://www.bizinfoportal.co.uk/2021/04/23/business-development-strategy-creating-long-term-value/ jurisdiction. In general, personal data is any information that can be used to identify the identity of a person. This includes things like the email address of a person or telephone number, however it includes any other information which can be linked to an individual, thereby identifying them. For instance the date of birth or maiden name of their mother biometric data, information regarding passports and visas, credit card details, and other sensitive information regarding employment (e.g. Performance ratings and disciplinary records).
The information should be able to be identified by others. If it is difficult for another person to recognize the information, it is not considered personal. This is known as the “practicability” test.
The final step to determine whether something is personal is that it must be related to a living, identifiable person. This excludes information that is business-related, such as invoices or orders.
Personal information that is sensitive can be extremely damaging if it is stolen, lost or divulged without authorization. It is crucial to educate employees on the importance of protecting sensitive PII. It is also important to take steps to protect the information when it is not in use such as by locking off computers unsupervised and destroying the paper records. It is vital to check regularly the PII in your system, and limit access to those who have a business reason to do so.