Pipeline draft · Privacy and compliance
DRAFTWhat counts as personal data, and what to do with it at work
This lesson left the pipeline and nobody published it. It passed the structure and concept-ordering gates; the rubric gate result below is read from the verdict files beside it. Rubric gate: passed with three independent models, means 4.63–5.00, largest disagreement on any one criterion 1 point. LLM rubric scores, not human QA.
- PRV-01Given a piece of information encountered at work, decide whether it is personal data, whether it is sensitive, and what handling that requires
The question is not "is there a name on it?"
**Personal data** is any information that relates to an identified or identifiable living person. The test is **identifiability**, not the obvious label. A name is personal data. So is an employee number, an email address, a phone number, a photograph, a vehicle plate, a device identifier, a home address. So is a combination of ordinarily harmless facts that together point at one person: a job title plus a department plus a start date identifies someone in a small team as surely as their name.
The question to ask is always: **"could someone work out who this is about?"** If the answer is yes, directly or by combining it with something else reasonably available, it is personal data and the rules apply.
Personal data with a higher handling bar: health information, religion, ethnic origin, political opinions, trade-union membership, biometric and genetic data, sexual life, and criminal records in most regimes. Not because these facts are secret, but because their disclosure can cause harm that cannot be undone. A sick-leave reason, a dietary requirement that reveals a religion, a photograph that shows a disability — each is sensitive even when it arrives in an ordinary email.
Personal data that has gone somewhere it should not have: the wrong recipient, a lost device, a public link that should have been private. Reported the same day to whoever owns privacy, not when you get round to it. The organisation's reporting obligations are measured in hours and days, and the clock usually starts when any employee becomes aware, not when the privacy officer does.
Key takeaways
- The test is identifiability: could someone work out who this is about?
- Sensitive data has a higher bar because its harm cannot be undone — even when it arrives in an ordinary email.
- Collect and use only what the task needs; a "just in case" copy is data nobody is protecting.
- Share on a need-to-know basis through approved channels; an internal forward without a need is still a disclosure.
- A data-subject request and a potential breach are both reported the same day — the clock started with you.
Decide, case by case
A colleague in another department asks you for a "quick list" of employees who took sick leave this quarter, with the reasons, so he can plan cover. You have the file. Work the decision step by step.
Knowledge check — not scored
A spreadsheet with no names: job title, department, start date and performance rating, for a team of six. Is it personal data?
Select one answer.
You emailed a customer's account statement, then noticed a minute later that autocomplete picked a different customer with the same name. The recipient probably has not opened it yet. It is 5 pm.
Knowledge check — not scored
A customer writes: "I want a copy of everything you hold about me, and delete my phone number." What is the correct action?
Select one answer.
Files in the repository: lesson.json · items.json · STATUS.md