For the purposes of the Data Protection Act 1998, what constitutes personal data?

"Personal data" under the Data Protection Act 1998 simply means information held on record about an individual. Information held in paper format, data stored on a computer system and data processed through email are all covered by the Act, which regulates the processing of data about individuals in employment.

Where information is held manually, it must be "structured in such a way that specific information relating to a particular individual is readily accessible" in order to be covered by the Act. This means in effect that the filing system in which the data is held must have a structure or referencing mechanism that allows information about specific individuals to be easily found. Furthermore, the file itself must be structured or referenced in such a way that specific information about the individual can be readily located within it, without the person who is seeking the data being required to leaf through the content.

The Court of Appeal has further held, in Durant v Financial Services Authority [2003] EWCA Civ 1746 CA, that to constitute "personal data", information must be biographical to a significant extent and have the individual as its focus. This suggests that the mention of a person's name in a document or email would not necessarily be sufficient to make the information "personal data" for the purpose of the Act where the individual concerned was not the focus of the correspondence.