This quick guide explains what counts as personal data, your legal responsibilities under GDPR, and the rights of the people you collect data from – in simple, practical terms.
Personal data is any information that can identify a person, directly or indirectly. Here’s a simple guide to understanding it and knowing when to be careful.
What is personal data?
Personal data isn’t just names or email addresses. It includes any piece of information that can point back to a person. Examples:
Name, phone number, email
Address or workplace
Date of birth
Bank account or payment details
Photos, video, or audio recordings
IP address, location data, or other digital identifiers
If someone could look at the information and reasonably figure out who it is about, it’s personal data.
When to be mindful
You should always handle personal data with care, but some situations need extra attention:
In contracts, consents and agreements – contracts often include names, signatures, and contact details.
Sharing documents – if you send contracts with sensitive details, think about who has access.
Storing data – don’t keep personal data longer than needed. Use Connie's in-built Expiration Date feature where possible.
Using external tools – make sure the services you use (like Connie) are GDPR-compliant and listed in your privacy policy. (We are, btw! Check our our Trust Center)
Handling requests – people have the right to ask for a copy of their data or for it to be deleted.
Your legal responsibilities (GDPR)
When you collect or process personal data in the EU, you are legally required to handle it in line with the General Data Protection Regulation (GDPR). This means you must:
Collect data only for a clear and lawful purpose.
Keep it accurate and up to date.
Store it securely and protect it from misuse.
Delete it when it’s no longer needed.
Be transparent by telling people how you use their data (e.g. in your privacy policy).
The rights of individuals
Under GDPR, the person whose data you collect (often called the data subject) has specific rights. These include the right to:
Access their data (request a copy).
Correct their data if it’s wrong.
Delete their data (“the right to be forgotten”).
Restrict or object to certain uses of their data.
Move their data to another provider (data portability).
You need to have processes in place to respond if someone exercises these rights.
Why it matters
Being mindful of personal data builds trust with your clients and partners, keeps you compliant with GDPR, and protects you from potential risks if something goes wrong.
💡Tip: You can read more about adding Connie to your privacy policy in this guide.
Disclaimer
Connie is not a law firm, and this information is provided for general guidance only. It does not constitute legal advice. You should consult with a qualified legal professional to ensure your Privacy Policy and contracts meet your specific legal and regulatory requirements.