What is personal data under the new FADP?
By Advisorn · updated on 25 October 2026 · Art. 5 let. a and b FADP, Art. 4 no. 1 GDPR
In short
Personal data is any information relating to an identified or identifiable natural person (Art. 5 let. a FADP): a name, an e-mail address, a telephone or customer number, a photograph, an IP address that can be linked to someone. Since 1 September 2023 the FADP protects only natural persons, no longer companies and other legal entities.
Identifiable is enough
A name is not needed: data is personal also when the person can be recognised by combining it with other information that the business holds or can obtain by reasonable means, for example a contract number, a car number plate or the description of an employee in a department of three people.
What counts is the point of view of whoever processes the data: information can be personal for the business that holds the key to link it to someone and not be personal for someone who does not.
Typical examples in an SME
- the list of customers and vendors with the names of the contact persons;
- personnel files, salaries and medical certificates;
- job applicants' CVs;
- e-mails, messages and recordings of telephone calls;
- video surveillance footage;
- data collected through the website: contact forms, cookies, IP addresses.
Related questions
Useful templates
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.