Data refers to facts or statistics collected for reference and analysis, in the form of numbers or words. Data gathering typically serves to support decision-making activities like counting product sales or taking electricity meter readings to analysing profitability of services provided.
Personal data as defined by the PDPO refers to any information which allows for identification of living individuals either directly or indirectly, including data regarding physical, physiological, genetic, mental, economic cultural and social identities of such people.
Companies should carry out an impact analysis when transferring personal data across jurisdictions, assessing risks associated with its transfer and its potential effect on individuals. Such assessments must be documented and updated periodically. When engaging a third-party (whether local or foreign) to process data on its behalf, companies must adopt contractual arrangements or other safeguards to prevent unauthorised access, processing, erasure or loss.