What is personal data? The GDPR definition with examples
Almost every privacy question starts with one thing: is it personal data? Only then does the GDPR apply. The concept is broader than many people think. This article explains what the law says, the difference between directly and indirectly identifiable data, and which data gets extra protection.
The definition in the GDPR
Under Article 4(1) GDPR, personal data is any information relating to an identified or identifiable natural person. A person is identifiable if they can be identified directly or indirectly, for example by a name, an identification number, location data, an online identifier or factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
- It concerns natural persons: living people. Data about a company as a legal entity is not covered, but an employee's name and email address are.
- "Any information" is broad: opinions, assessments and photos can be personal data too.
- Indirectly identifiable information counts as well.
Directly and indirectly identifiable
Directly identifiable data points to one person on its own, such as a name with an address, a national ID number or a passport photo. Indirectly identifiable data identifies someone only in combination with other information: a licence plate, a customer number, an IP address or a description such as "the only dentist in the village". Recital 26 GDPR says to consider all the means reasonably likely to be used to identify someone.
Examples of personal data
- name, address, town, phone number and email address;
- date of birth, national ID number, passport number and a copy of an ID document;
- IBAN, customer number, policy number and invoice details with a name;
- licence plate, IP address, cookie ID and location data;
- photos and camera images in which someone is recognisable;
- an appraisal, an absence record or a complaint file about a person.
Special category data
Some data is so sensitive that the GDPR in principle prohibits processing it (Article 9 GDPR): data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data used for identification, health data and data concerning a person's sex life or sexual orientation. There are exceptions, such as explicit consent or a legal obligation, but the bar is high.
Criminal offence data has its own rules in Article 10 GDPR, and many countries add extra rules for national ID numbers; see Redacting national ID numbers.
When is something not personal data?
Data about deceased persons, about companies as such and truly anonymous data falls outside the GDPR. Note that "anonymous" means nobody can reasonably identify the person any more. Replacing names with labels is usually pseudonymisation, and then the GDPR still applies. Read the difference in Pseudonymisation or anonymisation.
In practice: want to share a letter or document with a colleague, adviser or AI assistant? First remove the personal data the recipient doesn't need. VerumVault replaces names, ID numbers, IBANs, addresses and phone numbers with labels, locally in your browser.
Read also: Anonymise a document in 3 steps and GDPR for small businesses.
Anonymise your document for free with VerumVault →Runs locally in your browser · no upload · no accountFrequently asked questions
Is an email address personal data?
Yes, if it can be linked to a person, such as [email protected]. A generic address like [email protected] usually is not, unless only one person uses it.
Is an IP address personal data?
Often, yes. Combined with data held by the internet provider, an IP address can lead to a person. The Court of Justice of the EU has accepted this for dynamic IP addresses too, under certain conditions.
Is business data personal data?
Data about a legal entity, such as a limited company itself, is not. Data about a sole trader and employees' contact details often is, because it leads to a person.
What is special category data?
Data about health, religion, ethnic origin, political opinions, trade union membership, sexual orientation and genetic or biometric data, among others. Processing it is in principle prohibited (Article 9 GDPR).