gdpr
DSGVO: Saving adress data
<p>According to GDPR (DSGVO in germany), would it be allowed to save an adress without a name of the person?</p>
<p>Would it also be allowed to do the same with a hash of the persons name? The name of  the person can not be created with the hash but if someone tells me a name, I can recreate the hash and check if it was the same person that I have the adress from.</p>

<p>The GDPR does not put specific limits on what information can be saved, or what it must be associated with. But an address can fairly easily be related to a particular natural person, and so it is PI, and probably PII. Therefor, under article 6, there must be a lawful basis for saving it, and there must be a purpose (or purposes) for saving and processing it. The basis might be consent, or one of the other permitted lawful bases. It would be improper to use it beyond the original purpose without properly notifying the Data Subject, and in many cases obtaining consent to the revised purpose.</p>
<p>A one-way hash created with a good hashing function, that cannot be associated back to the address (or name or whatever PI) is not normally PI, and the GDPR does not put limits on its processing, unless there is a way to associate it with a natural person, or the data is already associated (such as by being part of the same DB record)</p>
<p>(PI is &quot;Personally Information, PII is &quot;Personally Identifiable In formation.)</p>
