Data Protection Definition: Principles & Impact

Everything you need to know about data protection & awareness training

What exactly is the definition of data protection?

Data protection is intended to protect the personal data of individuals from unauthorized and improper use.

This so-called "personal data," i.e., information that makes a person directly or indirectly identifiable, includes, for example, data such as full name, date of birth, address or telephone number. Particularly sensitive personal data (e.g., health, origin, political orientation, religion, etc.) belong to the special categories of personal data and are thus given special protection.

In Germany, the legal basis for data protection is provided by the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG), among others.

By the way: The EU General Data Protection Regulation (GDPR) does not apply in the EU, but to everyone who process data of EU citizens. A significant difference!

Overview: Data protection & personal data

Data is no longer considered personal if it has been anonymised in such a way that data subjects cannot or no longer be identified. For example, information in elections or surveys is anonymised so that it is no longer possible to identify a person. Likewise, collective e-mail addresses of a company with the format info@company.com, for example, are not personal. The statistics and marketing data used by companies for planning, research and market analyses are also no longer personal once they have been anonymised.

Here you can find an overview: 

 

Data Personal Not personal

Full name

 🗸  

Contact data

 🗸  

Address

 🗸  

Bank data

 🗸  

Biometric Data

 🗸 (special category)  

Origin

 🗸 (special category)  

Sexual orientation

 🗸 (special category)  

Health data

 🗸 (special category)  

Religion

 🗸 (special category)  

Political views

 🗸 (special category)  

Trade union membership

 🗸 (special category)  

Collective Company mail address

   🗸

Anomymised survey data

   🗸

​​​​​​​"Just do it?" Not with data protection

The principle of data protection is that every individual has the right to informational self-determination. On this basis, everyone should be able to decide for themselves how their data is processed.

In concrete terms, this means that the collection, storage and processing of personal data is basically prohibited by default, unless:

  • There is a legal authorisation (e.g. data at the tax office to determine the tax burden),
  • The data is needed to fulfil a contract (e.g. a sales contract between two people),
  • Or, the person concerned has expressly given consent.

Data protection awareness that works

We provide the perfect data protection training so that your employees know how data protection works.
Data Protection Training

Data protection principles: What do you need to consider?

Personal data is processed according to seven principles that are mandatory for every company or organisation:

  • Lawfulness and transparency: Data processing needs to be lawful and plausible for the data subject.
  • Purpose limitation: Processing may only be carried out for the purpose for which the data subject has consented.
  • Data minimisation: Only the data necessary for the purpose may be obtained and used.
  • Accuracy: Only correct, necessary and up-to-date data may be used.
  • Storage limitation: The respective data may only be used as long as necessary for the respective purpose (afterwards, they must be legitimately deleted).
  • Integrity and confidentiality: Adequate protection is the be-all and end-all, because the data must not only be protected from loss, but also from unlawful use.
  • Accountability: Compliance with data protection must be verifiable.

Data protection: Data subject rights

Every person whose personal data is collected and processed has the following rights:

  • Information/access: Any person may request information from authorities, companies or other bodies about their data stored with them.
  • Rectification: If the stored data is not correct, there is a right to have the data rectified.
  • Erasure/ to be forgotten: Provided that no law stands in the way, a person may request the erasure  of their data.
  • Objection: any person may object to the processing of their data on specific grounds. If the objection is justified, we must comply with it.
  • Withdrawal: Every person has the right to withdraw his or her consent to the processing of personal data without giving reasons.
  • Restrict processing: If there is a legitimate reason, the person may request the restriction of the processing of his or her data.
  • Data portability: Individuals have the right to receive their stored data in an electronic format.
  • Complaint: If a person does not agree with the processing of their data, they can lodge a complaint with the data protection supervisory authority.

Why is data protection so important?

As global digitalisation continues to spread, the need to better protect data and personal information is steadily increasing. Because with digitalisation, the criminal misuse of data has also increased.

This is also recognised by politicians with the implementation of laws such as the European Data Protection Regulation ('EU GDPR') or the Federal Data Protection Act ('BDSG'). Thus, the goal is: everyone should be able to determine for themselves who collects, stores and processes personal data, when and for what purpose.

So that your employees know how data protection works, we offer the appropriate data protection training.

IS-FOX data protection training : easy to understand and to the point. With refresher or test-out

Data protection is important. Therefore, as a company, you cannot avoid regular and often unpopular employee awareness training. So that you can fulfil your training obligation without overburdening your employees, we have thought about it and offer you data protection training that:

 

  • gets the important information across while being easy to understand,
  • provides practical recommendations for day-to-day work,
  • can be customized both to visually and content-wise,
  • provides a shortened version (refresher),
  • avoids legal jargon, where possible,
  • can be used with a test-out option.
Know-how: Refresh data protection training
Data Protection definition and meaning