Hacker News Reader

The definition of personal data in GDPR doesn't mention "created or provided by that person" in any way. Can you provide a reference limiting the scope past the definition in Article 4?

Article 14 explicitly talks about data not provided by the data subject, further clarifying that it is in scope.

View on HN

My wording wasn't quite right. GDPR refers to "personal data". I don't think all data about a person is "personal data" to be controlled by that person according to GDPR.

* are my interview notes during the hiring process "personal data" subject to GDPR provisions (disclosure, destruction, etc). * are my business meeting notes with a contractor subject to GDPR?

Both times: yes and no. They both are indeed considered personal data, but they don't always have to be disclosed (as disclosing might harm others)

Reply on news.ycombinator.com