GDPR Q2

What is considered personal data under GDPR?

Q2. What is considered personal data under GDPR?

Category: Data Types

Personal data is any information that can identify someone, directly or indirectly. If a detail can point to a person, even when combined with other clues, GDPR treats it as personal data.

In simple terms

Names, numbers, photos, and online IDs can all be personal data.
If information can be pieced together to identify someone, it counts.
Some sensitive details get extra protection under special category rules.

Everyday examples

Obvious identifiers include names, addresses, and ID numbers. Less obvious data like location history, IP addresses, or customer numbers also count when they relate to a person.

Contact details such as email, phone number, or home address.
Workplace information like job title, payroll number, or staff ID.
Online identifiers including IP addresses, cookies, and device IDs.

Special category data

Some personal data is highly sensitive. GDPR calls this ‘special category data’ and gives it extra safeguards. Organisations need both a lawful basis and a special condition to use it.

Health information, biometric data, or genetic details.
Racial or ethnic origin, religious beliefs, or political opinions.
Trade union membership, sexual orientation, or sex life details.

What is not personal data

If data has been truly anonymised so no person can be identified by any reasonable means, GDPR no longer applies. Pseudonymised data is still personal data because a person could be re-identified with extra information.

Aggregate statistics that cannot be traced back to an individual fall outside GDPR.
If you can link data back to a named person using other files, it remains personal data.
Always check whether combined data sets could unintentionally reveal identities.

Practical steps to take

List the information you collect and decide if it can identify a person.
Flag any special category data and confirm you have an Article 9 condition.
Keep identifiers separate from other data where possible to reduce risk.
Only collect sensitive details when absolutely necessary.
Document your decisions so you can explain them to the ICO or individuals.

Real-life examples

Customer support tickets

A helpdesk stores customers’ names, emails, and ticket histories. All of these are personal data because they relate to identified individuals.

Health survey

A community group asks residents about medical conditions. The responses are special category data and require strict safeguards.

Helpful reminders

Assume data is personal if there is any realistic way to identify someone.
Treat pseudonymised records with the same care as identifiable data.
Keep sensitive information under tighter access controls.
Regularly review datasets to ensure anonymisation remains effective.

Key takeaway

Personal data is broader than most people expect—when in doubt, protect it as if it could identify someone.