Privacy laws exist because personal data can be misused in ways that harm people and are hard to undo.
They turn privacy principles into duties that organisations must follow, with penalties for breaking them.
The GDPR in the European Union and the UK GDPR are among the most influential examples.
Similar laws exist in many other places, such as the CCPA in California and the DPDP Act in India.
Personal data includes anything that identifies a person directly or indirectly, from names to device identifiers.
Special categories, such as health, religion and ethnicity, get stronger protection.
Using personal data needs a lawful basis, such as consent, a contract or a legitimate interest.
People have rights to access, correct and delete their data, and to object to some uses.
Data minimisation means collecting only what a purpose needs.
Storage limits mean deleting data once it is no longer needed for that purpose.
Under many laws, breaches of personal data must be reported to regulators within set deadlines.
Sending personal data to other countries can need extra legal safeguards.
Pseudonymised data, where names are replaced by codes, still counts as personal data under the GDPR.
In practice, analysts work on the least identifying version of the data that answers the question.
The usual mistake is assuming that removing names puts data outside privacy rules.