What kind of data does the Act cover?

The Act applies to digital personal data. Personal data means any data about an individual who is identifiable by or in relation to that data. Digital means the data is either collected in digital form, or collected on paper and later digitised. That covers far more than most people assume: names, phone numbers and email addresses, but also a patient's diagnosis, an employee's attendance record, a customer's transaction history, a photograph, a voice recording, an IP address tied to an account, and location data.