> For the complete documentation index, see [llms.txt](https://open-data-institute.gitbook.io/data-governance-playbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://open-data-institute.gitbook.io/data-governance-playbook/play-eight-managing-risks-when-handling-personal-data/what-is-personal-data.md).

# What is personal data?

Personal data is defined by the [World Health Organization](https://apps.who.int/iris/bitstream/handle/10665/341374/WHO-EURO-2021-1994-41749-57154-eng.pdf) as ‘information relating to an identified or identifiable natural person’.

Personal data can be used to identify an individual either directly or indirectly. Directly identifiable data might include a person’s name, application log-in information, or social security number. Indirectly identifiable information is data that, when combined with other information, could identify an individual, for example geolocation, IP address or physical address. Figure 1 sets out the characteristics of personal and sensitive data often collected and shared about people.

![Figure 1: Types of Data About Us](/files/OuYpJw8qOaM0NjRa01vK)