The act protects ‘personal data’ which is any information that can be used to identify a person. Common examples are names, addresses, TRNs, etc., but it also includes sensitive information such as genetic or biological data, biological relationships, race, ethnicity, sexual orientation, religion, political opinion, philosophical belief, and health information.