Omar installed a new app, and the first thing it asked was to enter his details. He is about to type facts about himself.

His name, phone number, email and ID number are all personal data: any information about one specific person that can tell you who they are.

Even a detail that does not point to anyone alone, like a birth date, becomes personal data once it is linked to another, like an address.

Every field Omar fills goes to the company behind the app. That is why you should know what your data is before handing it to anyone.

Some personal data does far more harm than a name or an email if it leaks. These kinds are called sensitive data.

The first kind is health information, mental or physical. If Omar has a chronic illness or takes a treatment, that is his secret.

The second is genetic data, the third is biometrics: fingerprint, face, iris and voice prints.

Why stronger protection? You can change a stolen password, but your face and fingerprint stay with you for life.

Omar installed a new game, and out of nowhere it asks to read his messages, photos and contacts. Strange, right?

This is where the personal data protection law steps in. It sets the rules for collecting, processing, storing and transferring data, to protect your privacy.

The core rule: nobody may collect your data or share it with another party without your explicit consent.

So Omar can say no, and the game gets nothing unless he agrees of his own free will.

Is there ever a time someone may use your data without asking? Yes, but only in 5 cases set by law.

First and second: when the law itself requires it for a government request, or to protect national security.

Third, protecting a person's life or health, like doctors needing a patient's medical file during an emergency. Fourth, carrying out a court ruling.

Fifth, carrying out a contract, like a delivery company that must know your address to bring your order. Anything else needs your consent.

Omar filmed his friends in a funny video and wants to post it on TikTok right now. Before he taps Post, there are two things he must know.

First, privacy: a constitutional right that protects your secrets, correspondence and conversations. Nobody may barge into them.

Second, the right to your image: nobody may photograph you or use your image without your permission.

If several people appear, every one of them must agree before it is published. If even one says no, Omar must not post.

Omar signed up on a shopping site. The company wants to send him offers. There are two ways to do it, and the difference matters.

The first is prior consent: the site asks "do you agree?" first. Explicit consent must come before data is collected, not after.

The second is the objection system: the site starts sending on its own without asking, and keeps going.

It stops only when you object and press unsubscribe. In the first, you start it. In the second, you must stop it.

Omar tapped "Agree" on a page full of long text and read none of it. That page is called a privacy policy.

It is a document explaining how the company collects, uses, stores and protects your data.

Want to know where your data goes? Look for those four answers in the policy before you agree, not after.

Companies get a licence from the Personal Data Protection Centre to prove they follow the law.