Personal information

Adopts the California Consumer Privacy Act's definition: any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with a particular consumer or household; developers must disclose whether training datasets contain such personal information.

Under the CPPA portion of the bill, information about an identifiable individual (broadly capturing identifiers and other data that can identify a person) that is subject to privacy protections including consent, access, correction, de‑identification standards, and breach reporting obligations. The definition determines the scope of CPPA duties and the intersection with AIDA where AI uses personal information.

Information about an identifiable natural person, whether recorded or not, that can identify or be reasonably used to identify an individual; this definition is the focal point for the Act’s protections and the application of the Information Privacy Principles.

Defined in line with the Privacy Act 2020 as information about an identifiable individual, including traditional identifiers (name, address), technical metadata (IP addresses, device IDs), and data that may be inaccurate or fabricated (for example deepfakes or fake profiles) where a person can be identified. The guidance treats personal information as potentially present at all stages of an AI system's lifecycle.

Any information from which the identity of an individual can be reasonably and directly ascertained, or which, when combined with other information, would directly and certainly identify an individual.

Personal information means information relating to an identifiable, living natural person or, where applicable, an identifiable juristic person; it includes identifiers, contact details, biometric data, health, education, opinions and other information that can identify or be linked to a person.

Information relating to a natural person that identifies or makes the person identifiable; under the amendment this core definition anchors rights (e.g., portability, refusal of automated decisions) and the scope of processing, de-identification, and cross-border transfer obligations.

Any information recorded electronically or otherwise that identifies or can identify a natural person, either alone or in combination with other information. The PIPL frames this as the core object of protection and the trigger for its processing rules and individual rights.

Information that relates to an identifiable individual, including any data that directly or indirectly identifies a person. The CPPA uses this term to set the scope of protected data subject to statutory obligations and individual rights (access, correction, erasure).

Broadly defined as any information that relates to a natural person and allows that person to be identified, encompassing names, addresses, financial records, and health data, regardless of format.

Information about an identifiable individual, encompassing data such as name, address, identifying numbers, health information, educational history, and personal opinions, which is protected under the Act.