Organisations must provide not only information that they hold that specifically references the individual, but also anything that identifies them. Largely, this is a straightforward exercise, but in certain circumstances, the decision may be less clear and careful consideration is required.