Skip to content 
Personenbezogene Daten
Almost every decommissioned notebook, smartphone or multifunction device contains data about people: names in emails, phone numbers in the address book, faces in photos. As soon as such data is involved, the GDPR applies. This entry explains what personal data is, where it hides on old devices and what follows from this for decommissioning.
In brief
Personal data is any information relating to an identified or identifiable natural person, for example name, email address, employee number or location data. The definition is set out in Art. 4 no. 1 GDPR and is deliberately broad. For IT asset disposition, this means: almost every used data carrier contains such data and must be verifiably erased before it is passed on.
What counts as personal?
What matters is whether a person can be recognized directly or indirectly. A person is directly identified, for example, by their name. They are indirectly identifiable if information can be combined with other data, such as a customer number with the customer database. All means that are likely to be used according to general judgment count.
| Type | Examples | Typical storage location on old devices |
|---|---|---|
| Identification data | Name, date of birth, employee or customer number | Documents, databases, user profiles |
| Contact data | Email address, phone number, postal address | Mailboxes, address books, smartphones |
| Online identifiers | IP addresses, device IDs, cookies, login data | Browser storage, log files, network devices |
| Content | Photos, voice messages, conversation notes | Smartphones, tablets, network drives |
| Special categories | Health data, biometric data, religion, trade union membership | Personnel files, practice or laboratory systems |
Stricter rules apply to the last group under Art. 9 GDPR. More on this in the entry special categories of personal data.
What does not fall under the term
- Anonymous data: If a person can no longer be recognized even with reasonable effort, the GDPR does not apply.
- Data about companies: Revenue figures or company addresses are not personal data. It is different if they relate to a person, such as the email address of a contact person.
- Data of deceased persons: The GDPR protects only living persons. Other provisions such as professional secrecy may nevertheless apply.
Pseudonymized data, by contrast, remains personal, because the key can be used to restore the link to a person.
Rule of thumb: It is not the file that decides, but the question of whether someone can recognize a person with it – today or with reasonable effort.
What this means for decommissioned hardware
Deleted files, formatted hard drives or reset smartphones often still contain recoverable data. As long as that is possible, the protection obligations of the GDPR continue to apply, in particular the principles under Art. 5 GDPR. If the data falls into the wrong hands, there is a Data breach . Anyone decommissioning devices therefore needs a procedure that covers every Data carrier and documents the erasure for each device. Which traces can remain on old hard drives is shown in our article Corporate DNA on hard drives.
Personal data at Second IT
Second IT checks every device for all storage media at goods receipt and registers it by serial number. Erasure is performed with Blancco, including in hidden areas such as HPA and DCO, with a digitally signed erasure certificate for each device. In addition, identifying features of the customer, such as stickers, are removed completely. Employees are bound to data secrecy. More on Data security at Second IT.
Frequently asked questions about personal data
Is an IP address personal data?
In many cases yes. In 2016, the Court of Justice of the European Union ruled that even dynamic IP addresses can be personal data if the controller has legal means to attribute them to a person. You should therefore treat them as personal data on network devices and in log files.
Are business email addresses personal data?
Yes, if they are assigned to a person, for example vorname.nachname@firma.de. Functional addresses such as info@ without a personal reference generally are not.
Is it enough to delete personal files before handing over devices?
No. Deleted files can often be recovered, and data is also stored in caches, profiles or hidden areas. Only erasure of the entire data carrier with a verified method and documentation, or its physical destruction, is secure.
What is the difference between anonymous and pseudonymized data?
Anonymous data can no longer be attributed to a person even with reasonable effort, which is why the GDPR does not apply to it. Pseudonymized data remains personal, because the key can be used to restore the link to a person.
Are photos and voice messages personal data?
Yes, as soon as a person can be recognized in them, for example by their face or voice. Such content is often stored on smartphones, tablets and network drives. When decommissioning these devices, it must therefore be verifiably erased.
Verifiably remove personal data – on every device.
Send us your device list. You will receive your offer in 48 hours on average.