What is a Personal Data

Personal data is any information that is directly or indirectly traceable to a living, identifiable individual. It includes not only obvious data such as name, address or BSN number, but also e-mail addresses, IP addresses, phone numbers, license plates and even combinations of data that together can reveal a person's identity. The Personal Data Authority uses a broad definition: as soon as you can identify a person with reasonable effort, it is personal data. For SMEs deploying websites, ecommerce stores or marketing automation, this is essential to understand.

How the definition of personal data works in practice

The core is in identifiability. A single zip code is often not personal data, but a zip code plus house number is. An anonymous customer profile with only purchase behavior is not personal data, but as soon as you can link that profile to an e-mail address or cookie ID it becomes one. In practice, we see in SME companies that contact forms, newsletter subscriptions, Google Analytics data and CRM systems almost always contain personal data. Special personal data such as health data, political affiliation or sexual orientation also fall under stricter rules. The General Data Protection Regulation(AVG) requires you to have a legitimate basis for any personal data, such as consent or contractual necessity.

Why the AVG puts personal data front and center

The AVG came into effect in 2018 to give European citizens control over their own data. The regulation recognizes that personal data has economic value and misuse can lead to discrimination, identity fraud or reputational damage. For companies, this means being transparent about what data you collect, why you do it and how long you keep it. Fines can be as high as 4% of global annual sales, but for most SMEs, the risk of trust damage is greater than the fine itself. Customers today expect you to handle their data carefully and not resell or share it without permission.

What correct handling of personal data brings to SMEs

Als je persoonsgegevens op orde hebt, bouw je vertrouwen bij klanten en voorkom je juridische problemen. Een heldere privacy policy, een werkende cookiebanner en een proces voor inzageverzoeken laten zien dat je professioneel werkt. Dat vertrouwen vertaalt zich in hogere conversies: bezoekers vullen sneller een formulier in als ze weten dat hun gegevens veilig zijn. Daarnaast helpt een opgeruimde database met alleen relevante, actuele persoonsgegevens je om effectievere e-mailcampagnes te draaien en betere SEO-resultaten te behalen door gerichte content. Bij Monkey Vision integreren we AVG-compliance standaard in elk webdesign-traject, zodat je vanaf dag één conform werkt en je kunt focussen op groei in plaats van op juridische risico's.

Personal data is the foundation of almost every digital customer interaction. Whether you offer a contact form, send a newsletter or run an ecommerce store, you collect and process personal data. The trick is to do that purposefully and lawfully, so that you strengthen customer relationships without violating privacy rules. Below are four concrete situations in which SMEs use personal data and what to watch out for.

Customer relationship management and CRM systems

A CRM system is all about personal data: name, company name, e-mail, phone number, purchase history and notes about previous contact moments. This data helps you score leads, follow up on offers and approach customers personally. The AVG requires that you have a legitimate basis, usually a contractual relationship or legitimate interest. Make sure you have a processing agreement with your CRM vendor and that employees only have access to data they need. A common mistake is that old contacts remain in the system for years without an active relationship. Clean up at least annually and ask inactive contacts if they are still interested.

Email marketing and newsletters

For newsletters, you need explicit consent unless someone is already a customer and you offer similar products. You need to be able to prove that consent with a timestamp and the source of subscription. Use a double opt-in to make sure the e-mail address is correct and that the person has signed up themselves. Your newsletter should always include a working unsubscribe link and you should process unsubscriptions within 48 hours. Tools like ActiveCampaign or Mailchimp offer built-in AVG features, but you remain responsible for how you build lists. In SEO projects, we often see companies use their newsletter to draw visitors back to new content, which works well provided your permission is in order.

Web analytics and tracking

Google Analytics, heatmaps and advertising cookies collect personal data such as IP addresses, browser data and browsing behavior. Since the Schrems II ruling and the rulings of the Personal Data Authority, transferring personal data to the U.S. without additional safeguards is risky. Many SMEs therefore opt for Google Analytics 4 with IP anonymization and a processor agreement, or switch to European alternatives such as Matomo or Plausible. You need permission for tracking cookies, except for strictly necessary cookies such as session IDs. An ePrivacy-compliant cookie banner is required. Make sure the banner appears before loading tracking scripts and that rejecting is as easy as accepting.

When personal data is the right choice and when it is not

Collect personal data only if you really need it for a concrete purpose. Ask yourself: can I accomplish the same thing without name, address or date of birth? For a quote request, you need an e-mail address, but a date of birth usually doesn't. For a content download, an e-mail address often suffices, without a phone number or company name. The less you ask, the higher your conversion rate and the lower your AVG risk. Don't use personal data for purposes for which you didn't collect it, unless you ask for new consent. A common mistake is for companies to add contact information from quote requests to the newsletter without separate consent. This is not allowed and damages your reputation. Want to know how to use personal data smartly and AVG-proof in your web design or ecommerce store? Schedule a free 30-minute AVG scan at Monkey Vision. We walk through your site live, give three immediate points of improvement and an honest assessment of your risks. No sales pitch, just practical advice.