Fundamentals

Personal Data Protection: Principles and Basic Rights

By Daniel Sardá · Published on October 21, 2026

8 min read1,574 words

Protecting personal data means placing limits and safeguards on the decisions public and private organizations make with information about us.

An app asks for access to your contacts to provide a feature that seemingly does not need them. A store retains the email address used for a purchase and later combines it with other data to build a profile. In both cases, the important question is not only whether the information was provided voluntarily. It also matters what is done with it, for what purpose, for how long, and with what safeguards.

That is what personal data protection is about: the set of principles, rights, and responsibilities that limits the decisions public and private organizations make about information relating to people. Its purpose is not to turn every piece of data into a secret or prevent all use of it. It is to ensure that such use has a justification, is understandable, remains proportionate to its purpose, and can be challenged.

What is personal data?

Personal data is information relating to an identified or identifiable person, including where that identification is indirect. The definition includes obvious examples such as a name or identification number, but also online identifiers, location data, or combinations of traits that make it possible to distinguish someone.

This idea appears in both the Council of Europe’s Convention 108+ and the European Union’s General Data Protection Regulation. They are influential reference points, but their legal reach is not universal, and each country may adopt different definitions and rules.

The fact that a piece of data is not intimate does not make it irrelevant. A regular schedule, a purchase, or an address available in a registry may seem harmless in isolation. When combined, they can reveal routines, preferences, or relationships. Whether information can reasonably be linked to a person matters more than whether it includes that person’s name.

That is why it helps to distinguish two techniques:

• Anonymization aims to make it reasonably impossible to attribute information to a person again.
• Pseudonymization separates or replaces identifiers, but allows data to be reattributed using additional information.

Under the European framework, pseudonymized data remains personal data if reidentification remains possible. Removing a name from a table, by itself, does not guarantee anonymity.

Key idea: Personal data does not have to be secret. It is enough that it relates, directly or indirectly, to an identifiable person.

Protecting data throughout its life cycle

Protection does not end when data is collected. Processing is a broad concept: it includes collecting, organizing, consulting, combining, sharing, retaining, modifying, and deleting information. An organization may have obtained data lawfully and still create a problem by reusing it for an incompatible purpose, keeping it longer than necessary, or sharing it without sufficient safeguards.

Consider a retailer that asks for an email address to send a purchase receipt. Using it later to enrich an advertising profile raises a different question. The original disclosure does not, by itself, determine whether the new use is lawful, necessary, or reasonably expected.

This also explains why publicly accessible data is not automatically free for any reuse. Consulting a registry for a specific purpose and downloading it in bulk to classify people are different activities. The applicable exceptions and rules depend on the jurisdiction, but the change of context remains an important question.

Privacy, intimacy, and data protection are not the same

The three concepts are related, but they serve different functions. The right to privacy protects a sphere of life from unjustified interference. Intimacy often refers to its most reserved area: health, personal relationships, convictions, and other particularly sensitive matters.

Data protection focuses on the operations performed on identifiable information. It can apply even when the content is not intimate. For example, a public list may be used disproportionately or beyond the purpose that justified its publication.

Nor is data protection the same as information security. Security aims to prevent unauthorized access, loss, or alteration. It is indispensable, but it does not answer every question. A database may be perfectly encrypted and still collect more information than necessary or use it for an unjustified purpose. Digital security and data protection complement each other; they are not identical.

Principles turned into practical questions

References such as Convention 108+ and the GDPR converge on several general principles. They do not constitute a single worldwide law, but they offer useful vocabulary for assessing data processing. In everyday terms, they can be translated into these questions:

• Lawfulness, fairness, and transparency: Is there a valid justification? Does the person receive clear information? Does the use align with reasonable expectations?
• Purpose limitation: Was the purpose for collecting the data explained? Is it now intended for something incompatible?
• Data minimization and proportionality: Is only what is necessary being requested? A flashlight app, for instance, is unlikely to need an address book.
• Accuracy: Are there ways to correct incorrect information that could affect someone?
• Storage limitation: Is the data deleted or anonymized when it is no longer needed?
• Security: Are the risks of loss, alteration, disclosure, or unauthorized access reduced?
• Accountability: Can the organization explain and demonstrate the decisions it made?

The Spanish Data Protection Agency presents these principles within the European regime. Their broader value is that they require people to ask questions before collecting information just in case.

Key idea: Protecting data is not only about securing a database. It is also about justifying why it exists, what it contains, and how it is used.

Consent matters, but it does not settle everything

It is common to reduce data protection to checking or declining a box. That picture is incomplete. In some legal systems, including the European one, consent is only one of several bases that may justify processing. Legal obligations, contracts, public interests, or other grounds defined by the applicable law may also apply.

That does not make consent merely decorative. When it is the relevant basis, it must meet the conditions set by the applicable legislation. But acceptance does not make every practice acceptable: purpose limitation, proportionality, transparency, and security still matter.

The underlying issue is the real ability to understand and control decisions that affect one’s life. That control does not necessarily amount to ownership of information. Data may involve the rights of other people, legal duties, or public interests. Speaking in terms of safeguards, limits, and responsibilities is usually more precise than treating data as an object of absolute ownership.

What rights might a person have?

Specific rights vary by country. As a limited reference point, the European GDPR recognizes, among others, rights to information, access, rectification, erasure, restriction of processing, portability, objection, and safeguards against certain automated decisions. The Spanish Data Protection Agency summarizes that catalogue for people subject to that framework.

In practical terms, these mechanisms may allow someone to ask:

• what information exists about them and where it came from;
• the purpose for which it is used and with whom it is shared;
• how to correct inaccurate data;
• when they can object to a use or request erasure; and
• whether a significant decision was made solely through automated processes.

Not all of these rights exist under the same name, scope, time limit, or exception in every jurisdiction. In a specific case, the relevant local law and competent authority should be consulted. This explanation is a conceptual map, not legal advice.

A safeguard for autonomy, not an absolute prohibition

Information can make services, research, fraud prevention, public-interest communication, and innovation possible. Data protection should not assume that every flow of information is harmful. Nor should it accept that innovation or the public interest justifies every form of surveillance, profiling, or accumulation.

Balance requires known rules, legitimate purposes, and proportionate measures. Freedom of expression, access to documents, research, and security may call for exceptions or particular forms of processing; their scope should have a legal basis and appropriate safeguards. Convention 108+ recognizes the need to reconcile data protection with other rights and legitimate interests.

From a liberal perspective, these safeguards protect individual autonomy against informational power, whether exercised by the state or private actors. But they also constrain regulatory power: a broad and vague restriction can obstruct voluntary exchange, expression, or innovation without genuinely improving people’s security. The reasonable answer is neither the absence of rules nor total control, but responsibility, proportionality, and the possibility of review.

Key idea: Neither the public interest removes every limit nor data protection prohibits every use. The central question is whether the processing is justified and proportionate.

How to assess a use of personal data

When a platform, business, or public body asks for information, five questions offer a useful starting point: what it collects, why, for how long, with whom it shares it, and what options the person has. If the answers are vague, change without explanation, or bear no relation to the service, there is reason to examine the practice more carefully.

Personal data protection makes visible decisions that might otherwise remain hidden in forms, databases, and algorithms. Its essential contribution is simple: anyone who uses information about others should be able to explain their reasons, limit themselves to what is necessary, and answer for the consequences. To determine which mechanisms may be required in an actual case, the next step is always to consult the law of the relevant jurisdiction.