The case of creating personal data by combining non-personal data
<p>In a company, two isolated departments process data that is not personal data. After processing, the documents go to the trash. They are found there by someone and it turns out that they identify people when put together - so they become personal data. Should the company that processed this non-personal data treat them as personal data? Do companies, on the basis of law, need to analyze the possibility of personal data being generated from non-personal data processed in it?</p>

<p>Non-Personal data defines that that can't be traced to certain people/entities.</p>

<p>By that definition it doesn't matters how much non-personal data you accumulate, you won't be able to create personal data from it.</p>

<blockquote>
  <p>Do companies, on the basis of law, need to analyze the possibility of personal data being generated from non-personal data processed in it?</p>
</blockquote>

<p>No, since non-personal data cannot be made personal without adding new personal information.
I strongly recommend to analyze if the currently collected "non-personal" data truly fulfills the definition of "non-personal" data.</p>

<p>This document can help:</p>

<p><a href="http://www.europarl.europa.eu/RegData/etudes/BRIE/2018/618988/IPOL_BRI(2018)618988_EN.pdf" rel="nofollow noreferrer">http://www.europarl.europa.eu/RegData/etudes/BRIE/2018/618988/IPOL_BRI(2018)618988_EN.pdf</a></p>

gdpr data-protection data-ownership