Data Privacy

Short answer: Data privacy concerns personal data: any information that points to a specific person, such as names, email addresses, account numbers, location data or call recordings. It matters most when a company connects systems, copies records between them or feeds them into AI tools. Each of those steps moves personal data to a new place or a new use. Privacy covers whether the company should collect the data at all and what it may use it for. It also covers who may see it, how long the company keeps it and what rights the person has over it. Data protection laws in many countries turn these questions into legal duties.

Data privacy and data security are related but different. Security protects data against people who should not see it, and against changes, loss or outages. Privacy also covers approved uses that a person would not expect or has not agreed to. Examples include reusing customer support records for marketing, or keeping old job applicant files for years. Data protection laws share a few common principles. Have a valid reason, such as consent or a contract, before using personal data. Only collect what the task needs. Use the data only for the purpose the company gave when it collected it. Keep it accurate. Delete it once the company no longer needs it. Keep it secure. Many laws also give people the right to see the data a company holds about them, correct it and in some cases have it deleted.

In practice, privacy work starts with a list of the personal data the company holds. The list shows where each type of data sits, where it came from and who can access it. For each use, the company records the purpose and its reason for the use. It sets how long to keep each type of data. When that period ends, the team deletes the data or removes anything that identifies the person. Privacy notices tell people how the company uses their data. A set process handles requests from people to see, correct or delete their data within legal deadlines. Contracts with suppliers who handle personal data set out their duties. Before the company launches a new system or AI tool, the team checks what personal data it will use and where that data will go.

A company's customer system holds 40,000 contact records. Its policy says to remove contacts after three years without activity. A review finds 12,000 records that have had no activity for longer than that. The company deletes them, leaving 28,000. In the same review, the marketing team asks to feed 18 months of support call transcripts into an AI tool to target offers. The company had told customers it recorded calls for quality and training. So it pauses the request. First, it checks whether marketing use fits that original purpose, or whether it needs customer consent and an updated notice.

Data privacy shapes many technology decisions. These include which customer and employee data to collect, which tools and suppliers may handle it and how long to keep it. It also decides whether a new use is acceptable, such as feeding customer records into an AI tool. Deleting data on schedule shrinks the amount that could leak in a breach. It also makes requests from individuals faster to answer.

Obligations differ by country, region and sector. A company that serves customers in several places may have to meet more than one set of rules. Removing names alone does not usually make data anonymous. Someone can sometimes identify a person again by combining the data with other sources, so it may still count as personal data. Sending personal data to outside AI services or overseas suppliers can bring extra requirements for contracts and transfers.