gdpr
Is storing business data considered personal data?
<p>I want to create an online application. The visitor could enter his website URL then the application will make some analysis. The application asks the visitor if he wants a regular website report on e-mail. I don't want to store personal data as I don't want to write a consent or something else. So I will request the visitor to enter a (non personal e-mail address) business e-mail address like "admin@example.com" or "mywebsite@yahoo.com" to send the report to.</p>

<p>This should not be considered personal data, right? Some tips?</p>

<p>Thank you so much!</p>

<p>The accepted answer is wrong. The way of getting the data doesn't matter in light of the GDPR. </p>

<p>Whilst it is true that it has to be <em>personal</em> data (about individuals residing in the EU), personal has a very <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&amp;from=EN#d1e1489-1-1" rel="nofollow noreferrer">broad meaning</a> (more <a href="https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en" rel="nofollow noreferrer">examples</a>). It is true that info@company.com is not personal data. However, when the user can be identified it <em>is</em> personal data, even if no explicit names are used (eg. cto@company.com). Moreover, if you process any data that indirectly make a person identifiable (eg. location data, ip-address, certain id's, device id's, ...), it will also be personal data.</p>

<p>In any case, in no way does a user entering information against your directions lift your duty to comply with the GDPR. Because, the moment you process personal data (the way you got it doesn't matter) GDPR is applicable. And processing is a <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&amp;from=EN#d1e1489-1-1" rel="nofollow noreferrer">very broad</a> concept under GDPR (more <a href="https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-constitutes-data-processing_en" rel="nofollow noreferrer">examples</a>). Even 'shredding documents containing personal data' is processing. So, the moment data "passes through your code", you are processing data. Obviously, the risks will differ with different kinds of processing, but that's a risk that you have to assess (this is in fact an obligation under GDPR).</p>

<blockquote>
  <p>Is storing business data considered personal data?</p>
</blockquote>

<p>No. <em>Personal data</em> refers to that of natural persons (i.e., human beings). </p>

<p>Your direction (if conspicuously stated) that the user enter non-personal data is a good idea, since it precludes a duty to comply with the GDPR. If notwithstanding your direction the user enters an email address with personal identifier(s), that user forfeits the protections enacted in the GDPR with respect to that email address.</p>
