Skip to main content
Skillrung

Recognising personal data and processing in your everyday work

Personal data is any information that makes it possible to identify someone, directly or indirectly, on its own or combined with another: a staff number or a case number is personal data. Processing covers the ordinary actions of work, from viewing a file to deleting it. Sensitive data, for its part, follows a stricter rule: processing it is prohibited in principle, unless an exception expressly provided for by the Regulation applies.

  • Written by Skillrung team
  • Review by a subject-matter expert under way
  • Updated on
Read the first 4 slides, freePlay the Discovery quiz, free

What is this course about?

Spot, in your own files, what counts as personal data, what is sensitive, and what already counts as a processing operation.

This is a core course: the material taught is the same for everyone, only the examples, the tools mentioned and the people you deal with change with your job. It has 3 sections, of which 1 section is followed by a quiz, and reads in 20-30 min. The legal framework cited is French law.

Your ordinary files are already processing operations

You open a file, you export a list, you send it to two colleagues, you archive the lot. None of that looks like law. Yet every one of those actions has a name in the Regulation, and the files concerned are not only the ones in your business software: they are also the spreadsheets that live alongside it, in your structure. Start by learning to recognise them.

Key points

Four markers to keep in mind

Four markers this section sets out, in the order in which you will meet them.

  • Indirect identification is enough: staff number, case number, identifier
  • Viewing, copying, sending, deleting: all of them processing operations
  • Sensitive data follows a stricter rule
  • The working copy is the most forgotten processing operation

What you will be able to do

  • Take stock of what you handle before naming data, processing operations and sensitive categories.
  • Recognise personal data, sensitive data and a processing operation in your own work.
  • Turn these markers into actions applied to your own files as early as this week.

The first 4 slides, free

What you read with no account and no card. Here, the generic version; in the player, the examples take the vocabulary of your job.

Try it, before you even create an account

Choose a job: the passage below is rewritten straight away. Nothing is saved, and no extra content opens.

No job selected: the generic version is being shown.

Generic version
You open a file, you export a list, you send it to two colleagues, you archive the lot. None of that looks like law. Yet every one of those actions has a name in the Regulation, and the files concerned are not only the ones in your business software: they are also the spreadsheets that live alongside it, in your structure. Start by learning to recognise them.

Real extract from the free slide “Your ordinary files are already processing operations” of this course.

  1. FreeSlide 1 of 13 · Your files, seen differently

    Your ordinary files are already processing operations

    You open a file, you export a list, you send it to two colleagues, you archive the lot. None of that looks like law. Yet every one of those actions has a name in the Regulation, and the files concerned are not only the ones in your business software: they are also the spreadsheets that live alongside it, in your structure. Start by learning to recognise them.

  2. FreeSlide 2 of 13 · Your files, seen differently

    What you will be able to spot afterwards

    • Spot indirect identification in a file with no names
    • Name the everyday actions that are already processing operations
    • Tell sensitive categories apart from the rest of your data
  3. FreeSlide 3 of 13 · Your files, seen differently

    Four markers to keep in mind

    Four markers this section sets out, in the order in which you will meet them.

    • Indirect identification is enough: staff number, case number, identifier
    • Viewing, copying, sending, deleting: all of them processing operations
    • Sensitive data follows a stricter rule
    • The working copy is the most forgotten processing operation
  4. FreeSlide 4 of 13 · Your files, seen differently

    Where do you stand?

    One question before we get to the heart of it, with no score and no judgement: it is about the line between a harmless file and personal data.

    1 short questions, marked immediately, inside the course.

These 4 slides can be read in the player, with no account and no card.

Read the first slide

Programme

3 sections, 13 slides and 4 quizzes in total. Each content section ends with a quiz that checks it has been learned.

  1. IntroductionFree

    Your files, seen differently

    Take stock of what you handle before naming data, processing operations and sensitive categories.

    • 4 slides
  2. SectionSubscribers

    What you really handle

    Recognise personal data, sensitive data and a processing operation in your own work.

    • 7 slides
    • Section quiz: 5 questions
  3. RecapSubscribers

    Your action plan

    Turn these markers into actions applied to your own files as early as this week.

    • 2 slides

9 slides are for subscribers

The first four slides of this course can be read without an account and without a bank card. From the fifth on, the €29.99/month incl. VAT subscription is needed. The Beginner level quiz, though, stays free: it measures your level without asking you for anything.

Subscribe, €29.99/month incl. VATPlay the Discovery quiz, free

How your level is measured

  • Beginner
    Questions drawn
    10
    Pass mark
    70 %
    Question bank
    ≥ 30
    Time limit
    20 min

    Free, no account and no subscription.

  • Intermediate
    Questions drawn
    12
    Pass mark
    75 %
    Question bank
    ≥ 36
    Time limit
    24 min

    Subscribers only, once the Beginner level is passed.

  • Expert
    Questions drawn
    15
    Pass mark
    80 %
    Question bank
    ≥ 45
    Time limit
    30 min

    Subscribers only, once the Intermediate level is passed.

The level shown for a course is the highest level you have passed, with your best score and its date. Questions are drawn at random on every attempt. Play the Beginner quiz for this course or read how we measure your level.

Which jobs is it for?

Common core: the examples change with your job, what is taught stays the same. It addresses all 58 jobs in the directory. See courses by job.

Frequently asked questions

Is a file that contains no names really covered?

Yes, as soon as it leads back to someone. A staff number, a case number or an access identifier point to a person by cross-referencing, and that indirect identification is enough. So the useful question is not “is there a name?”, but “can we tell who this is, on its own or by cross-checking with another file?”.

What makes a piece of data “sensitive” rather than ordinary?

The fact that it belongs to a category the Regulation lists: health, political opinions, religious beliefs, trade union membership, alleged racial or ethnic origin, sex life or sexual orientation, genetic data and biometric data used to identify a person. Processing it is prohibited in principle, unless an exception expressly provided for by the Regulation applies. Offences and convictions, for their part, fall under a separate regime, itself strictly framed.

Does the spreadsheet I keep alongside the software really count?

Yes, and it is the one that gets forgotten. A list that has been exported and then annotated carries personal data, goes out to recipients and has a lifespan: a processing operation in its own right. The reflex to acquire comes down to one decision taken before the export — when it will be deleted, and by whom.

What can I read without a subscription?

The first four slides of every course are available without an account and without a subscription, as is the Beginner level quiz. From the fifth slide onwards, the €29.99/month incl. VAT subscription is required. Creating a free account unlocks no extra slide: it keeps your progress, your job and your results.

How is my level measured?

By three level quizzes: Beginner (10 questions, 70 % to pass), Intermediate (12 questions, 75 %) and Expert (15 questions, 80 %). The level shown is the highest level passed, with the best score obtained and its date.

Who writes and who reviews this course

  • Skillrung team

    Editorial team of skillrung.com

    The skillrung editorial team writes the courses from the publications of the French and European authorities: ANSSI, CNIL, Cybermalveillance.gouv.fr, Légifrance and EUR-Lex. Every figure is tied to its primary source, dated and verifiable from the course page. The team does not stand in for an expert reviewer: every course intended for publication is reviewed by a named professional of the field concerned, whose name and review date appear on the course page.

Artificial intelligence assisted the drafting. Editorial responsibility for the published text remains human.

Statements with regulatory scope verified on .

Sources

Every figure stated in this course points to a primary source, dated and verifiable.

  1. Règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 (RGPD)

    EUR-Lex, Union européenne, published on

  2. Le registre des activités de traitement

    CNIL, published on

  3. Les bases légales d'un traitement de données personnelles

    CNIL, published on

  4. Les durées de conservation des données

    CNIL, published on

  5. Professionnels : comment répondre à une demande de droit d'accès ?

    CNIL, published on

  6. Travailler avec un sous-traitant

    CNIL, published on

  7. Notifier une violation de données personnelles

    CNIL, published on

  8. Transférer des données hors de l'Union européenne

    CNIL, published on

What Skillrung is not

  • Skillrung is not a French training body certified under the Qualiopi scheme.
  • As things stand, our content is not eligible for the French CPF, OPCO, DPC or FAF funding schemes.
  • A Skillrung certificate of completion is not a diploma, not a professional title and not a qualification registered in any national register. It records a result obtained in an unsupervised online assessment, on a given date.
  • Taking a Skillrung course does not make your organisation compliant and does not replace the obligations that fall on your employer or on you.
  • Our content is educational. It is neither legal advice, nor medical advice, nor a security audit.
  • For a self-employed professional or a company, the subscription is a deductible business expense : confirm this with your accountant.

Same topic

The other compliance & personal data courses

See the whole catalogueOur method

Keep going on Skillrung

The pages that follow on from this one, in the recommended order.