Privacy 101: your data, who collects it, and what rights you have

Privacy is not about having something to hide. It is about who gets to know things about you, and what they are allowed to do with that knowledge.

Think about an ordinary day. You unlock your phone with your face. You check messages, scroll through a feed, look up directions. You pay for coffee by card, scan a loyalty card at the supermarket, log into your bank, maybe a government portal. You walk past cameras, your phone talks to cell towers, a dozen apps quietly refresh in the background.

By the evening, dozens of organizations hold pieces of your life: where you were, who you talked to, what you bought, what you searched for, what you look like. Most of this is legal. Some of it is useful to you. Almost none of it is under your control.

This article explains, in plain language, what personal data is, who collects it and why, what the law requires of the organizations that hold it, and what you can do about it starting today.

What counts as personal data

Personal data is any information that relates to an identified or identifiable person. The definition is deliberately broad.

The obvious examples: your name, ID number, home address, phone number, email, date of birth, photo.

The less obvious ones: your IP address, the advertising ID of your phone, your location history, the cookies that recognize your browser, your voice on a recorded call, your car's number plate, your bank transactions. Even data that looks anonymous can become personal when combined: a date of birth, a postcode and a gender are enough to single out most people.

Some categories get extra protection because misuse can cause serious harm: health data, biometric data (your face, your fingerprint), genetic data, religious or philosophical beliefs, political opinions, trade union membership, sex life or sexual orientation, and racial or ethnic origin. The law calls these special categories, and processing them is forbidden unless a specific exception applies (Art. 9). Data about criminal convictions and offences has its own rule: it may be processed only under the control of an official authority or where the law authorises it (Art. 10).

A few terms worth knowing, because they appear in every privacy notice you will ever read:

• Data subject: you, the person the data is about.
• Controller: the organization that decides why and how your data is used (your bank, your employer, the app you installed).
• Processor: a company that handles the data on the controller's behalf (a cloud provider, a payroll service, an email marketing platform).
• Processing: anything done with data. Collecting, storing, reading, sharing, analyzing, and deleting all count.

Who collects your data, and why

Your phone and its apps. Every permission you grant (location, contacts, microphone, camera, photos) is a data pipeline. A free flashlight app that asks for your contacts is not asking for your benefit. The business model of most free apps is advertising, and advertising runs on data.

Platforms and advertising networks. Social networks, search engines and the ad-tech companies behind them build profiles from what you click, watch, pause on, and search for. Trackers embedded in ordinary websites report your visits back to them. Data brokers buy, merge and resell these profiles.

Telecom operators and banks. They must keep certain records by law (who called whom, who paid whom, identity checks when you open an account). They also use your data for marketing and credit decisions.

Your employer. HR files, payroll, your work email, access logs, and in some workplaces, monitoring software.

Governments. Civil registry, tax, health, vehicle, social security and electoral records, increasingly accessible through online portals. These are among the most sensitive datasets in any country, because they are complete, accurate, and tied to your official identity.

Everyone in between. Online shops, delivery apps, gyms, hotels, schools, clinics, insurers, the loyalty card you scanned this morning.

If a service is free, you are usually paying with data. But paid services collect too. The question is never whether data is collected. It is whether the collection is proportionate, transparent, and under your control.

Why it matters: the harms are concrete

Privacy harms rarely look like a Hollywood hack. They look like this:

Identity fraud. With your name, ID number, date of birth and address, a criminal can open accounts, take out small loans, or convince your mobile operator to issue a new SIM card and take over your phone number, and with it your bank's SMS codes (the attack known as SIM swapping).

Better scams. Phishing works when it sounds credible. A caller who knows your salary, your employer and your car's plate number is far more convincing than one who does not. Leaked datasets make everyday fraud more effective for years after the leak.

Profiling and discrimination. Decisions about credit, insurance, housing or hiring increasingly rely on data you never saw and cannot correct.

Physical safety. A leaked home address or live location is a safety problem for anyone with a stalker, an abusive ex-partner, or a public profile.

Permanent loss of control. Data does not come back. Once a dataset leaks, it circulates indefinitely, gets merged with other leaks, and resurfaces whenever someone finds a new use for it.

A case in point: Albania, where we are based, lived through this in 2021. In April, two weeks before parliamentary elections, a database with the personal data of around 910,000 citizens, roughly a third of the population, was published online. In December, the salaries, job titles and ID numbers of about 637,000 employees, taken from the tax administration, followed, together with the vehicle registration records of more than half a million people. Those files never disappeared. Many of the suspicious calls and messages Albanians receive today are credible precisely because they draw on data that leaked years ago.

Regulators have been treating this seriously. By March 2026, European data protection authorities had issued 2,685 fines under GDPR, totalling about EUR 6.11 billion. The largest single fines went to Meta (EUR 1.2 billion, 2023) and TikTok (EUR 530 million, 2025). The most common reason for a fine is the most basic one: processing personal data without a valid legal basis.

The rules organizations must follow

The General Data Protection Regulation (GDPR) is the EU's data protection law and the global reference point. It rests on seven principles that every organization handling personal data must respect (Art. 5):

1. Lawfulness, fairness and transparency. There must be a legal reason to process your data, and you must be told about it.
2. Purpose limitation. Data collected for one purpose cannot quietly be used for another.
3. Data minimisation. Only what is needed, nothing more.
4. Accuracy. Wrong data must be corrected.
5. Storage limitation. Data must be deleted when it is no longer needed.
6. Integrity and confidentiality. Data must be protected against breaches, with appropriate security measures.
7. Accountability. The organization must be able to demonstrate all of the above.

To process your data at all, an organization needs one of six legal bases: your consent, a contract with you, a legal obligation, your vital interests, a public task, or its own legitimate interests, provided those do not override your rights (Art. 6).

Consent has rules of its own. It must be freely given, specific, informed and unambiguous. Pre-ticked boxes do not count. Silence does not count. It must be as easy to withdraw as it was to give, and a service cannot be made conditional on consent to data that the service does not actually need (Art. 7). For children's online services, consent requires a parent below the age of 16, which EU countries may lower to 13 (Art. 8).

Organizations must secure the data they hold, notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to put your rights at risk, and inform you directly when the breach is likely to put you at high risk (Art. 32 to 34). A data protection officer (DPO) is mandatory for public authorities, and for organizations whose core activities involve regular and systematic monitoring of people on a large scale, or large-scale processing of special categories of data or criminal-offence data (Art. 37).

The penalties are what made GDPR famous: up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious violations (Art. 83).

Your rights

This is the part most people never use, and it is the part that gives you leverage.

How to exercise them: write to the organization, ideally to the DPO or privacy contact listed in its privacy notice, say which right you are exercising, and keep a copy. The organization has one month to respond, extendable by two further months for complex requests (Art. 12). It cannot charge you for a first copy of your data. If it ignores you or refuses without a valid reason, complain to the supervisory authority.

Does GDPR protect you if you are not in the EU?

More often than people think. GDPR applies in three situations (Art. 3):

• You are in the EU. Your location at the time of processing matters, not your nationality. Anyone living, working or studying in an EU country is covered.
• The organization is established in the EU. When an EU-based company processes your data, GDPR applies wherever you are. Several of the largest platforms serve users outside North America through their European entities, so GDPR obligations often apply to your data even when you are not in Europe.
• A non-EU organization targets people in the EU. A company anywhere in the world that offers goods or services to people in the EU, or monitors their behaviour, falls under GDPR for that activity.

The practical consequence for a business outside the EU: if you sell to EU customers, host EU visitors, or run a website aimed at your country's diaspora in Europe, GDPR applies to you in addition to your national law.

Ten things you can do today

1. Audit your app permissions. Set location to “while using” or “never” for apps that do not need it. Revoke contacts, microphone and camera access from apps that have no reason to have it.
2. Switch off ad personalization. On iPhone, deny tracking requests and turn off personalized ads in Settings. On Android, delete or reset your advertising ID.
3. Use a password manager and two-factor authentication. Leaked passwords are tried against your other accounts within hours. Unique passwords and 2FA break that chain.
4. Check whether your email has already leaked. Have I Been Pwned (haveibeenpwned.com) tells you which known breaches include your address. Change those passwords first.
5. Do not hand over your ID unless the law requires it. A shop, a gym or a website rarely needs a photo of your ID card. Ask why, and ask how long they keep it.
6. Read the consent box, then untick it. Marketing consent is optional by law. On websites, reject non-essential cookies; the “reject” option must be as easy as “accept”.
7. Exercise one right this month. Send an access request to one company that holds a lot of your data. The response is often eye-opening, and it reminds organizations that someone is watching.
8. Lock down your social profiles. Make your friends list, phone number and birthday private. Never post boarding passes, documents, or your live location.
9. Treat callers who “know things about you” as suspect. Knowing your details is not proof of legitimacy. Hang up and call the organization back on its official number.
10. Keep your devices updated. Most spyware and malware exploit vulnerabilities that already have a patch. Updates close the door. We explained why in our article on Pegasus.

If you run a business

Everything above applies to you from the other side. If you hold data about customers, employees or website visitors, you are a controller, and the obligations are yours:

• know what personal data you hold, where it lives, and why (a record of processing activities);
• have a lawful basis for each use, and a privacy notice that explains it in plain language;
• collect consent that is real, and keep proof of it;
• protect the data with appropriate technical and organizational measures;
• have a plan for a breach, because the 72-hour clock starts when you become aware of it;
• put contracts in place with every processor that handles data on your behalf;
• appoint a data protection officer where the law requires one.

None of this requires a legal department. It requires a map of your data, a handful of documents, and a few habits. Our privacy and data protection team does this with businesses every week, from the first inventory to the DPO role.

Sources

1. Regulation (EU) 2016/679 (GDPR), full text on EUR-Lex: https://eur-lex.europa.eu/eli/reg/2016/679/oj
2. European Commission, data protection in the EU: https://commission.europa.eu/law/law-topic/data-protection_en
3. CMS, GDPR Enforcement Tracker Report 2026, numbers and figures (data to 1 March 2026): https://cms.law/int/publication/gdpr-enforcement-tracker-report/numbers-and-figures
4. Exit.al, “The leak of over 910,000 Albanians' personal data” (April 2021): https://exit.al/en/2021/04/16/exit-explains-the-leak-of-over-910000-albanians-personal-data-to-politicians/
5. Balkan Insight, “Massive data leaks in Albania pose public security question” (December 2021): https://balkaninsight.com/2021/12/23/massive-data-leaks-in-albania-pose-public-security-question/