Under the GDPR, the personal data definition covers any information relating to an identified or identifiable living person. That phrase is deliberately wide. It reaches obvious identifiers like names, ID numbers, and photographs, but it also captures things most people would not think of as personal, including IP addresses, cookie strings, location pings, and opinions someone else has written about you. Whether information falls inside this definition decides whether an organization must comply with the full regulation and face fines of up to €20 million or 4% of worldwide annual turnover for getting it wrong.
What Article 4(1) Actually Says
Article 4(1) defines personal data as “any information relating to an identified or identifiable natural person.”1General Data Protection Regulation (GDPR). Art. 4 GDPR Definitions Each word carries weight. “Any information” is as broad as it sounds: names, numbers, images, location data, a manager’s note in a performance review, an assessment of someone’s creditworthiness. The information does not have to be true, private, or sensitive. If it relates to a person who can be identified, it is personal data.
The “relating to” element is where organizations most often stumble. Data relates to a person when its content is about them, when the purpose of collecting it was to learn something about them, or when using it is likely to affect them. A temperature reading from a warehouse sensor probably relates to no one. The same reading logged next to an employee’s shift schedule and used to evaluate working conditions starts to relate to the workers on duty. Context, not the raw data point, controls the answer.
Who the Regulation Protects
The GDPR protects “natural persons,” meaning living human beings. Companies, agencies, and other organizations are not data subjects, though the individuals who work inside them are. A corporate email address like jane.smith@company.com is personal data because it identifies a specific person, even in a business context.1General Data Protection Regulation (GDPR). Art. 4 GDPR Definitions
Deceased individuals fall outside the regulation’s scope. Recital 27 states plainly that the GDPR does not apply to the personal data of deceased persons, though individual EU member states can adopt their own rules for handling such data.2General Data Protection Regulation (GDPR). Recital 27 – Not Applicable to Data of Deceased Persons
Protection does not depend on citizenship or residency. Article 3 ties the regulation’s reach to whether the person is physically located in the EU when their data is collected, not to whether they hold an EU passport. A U.S. tourist browsing a website from Paris is protected. The same person browsing from home in Chicago is generally not, unless the site specifically targets people in the EU by offering goods or services there or monitoring their behavior within the EU.3General Data Protection Regulation (GDPR). Art. 3 GDPR Territorial Scope
When Someone Counts as Identifiable
A person is “identified” when you know who they are from the data itself: a full name on an order form, a photograph, a national ID number. The harder question is when someone is merely “identifiable,” meaning not yet identified but reachable through further steps.
Recital 26 sets the test. You must consider all means “reasonably likely” to be used, whether by your organization or by anyone else, to identify the person. The regulation does not require that identification be easy or cheap. It asks whether it is realistically possible given available technology, the cost involved, and the time it would take. If a determined actor with access to other datasets could match your data to a real person, that data is personal data in your hands too.4General Data Protection Regulation (GDPR). Recital 26 – Not Applicable to Anonymous Data
Identification runs along several paths. Direct identification relies on a single data point that pins down one person, such as a Social Security number or a biometric scan. Indirect identification works by combining pieces of information that are harmless in isolation but revealing together: a birth date, a zip code, and a job title can narrow a dataset to a single individual. Recital 30 confirms that digital identifiers including IP addresses, cookie IDs, and RFID tags can serve the same function, especially when they leave traces that let organizations build user profiles over time.5General Data Protection Regulation (GDPR). Recital 30 – Online Identifiers for Profiling and Identification
Three concepts help frame the risk. Singling out means isolating one person’s records within a dataset, even without knowing their name. Linkability means connecting records across different datasets to narrow in on someone. Inference means deducing personal details from patterns in the data, such as guessing someone’s health status from their pharmacy purchases. If any of these paths leads to a real person, the data qualifies as personal.
Examples of What Qualifies as Personal Data
Because the definition is so broad, the practical list is long. Some items are obvious; others catch organizations off guard.
- Identity information: full name, home address, date of birth, national ID or passport number, driver’s license number
- Contact details: email address (personal or corporate), phone number, social media handle
- Online identifiers: IP address, cookie ID, device fingerprint, advertising ID, RFID tag
- Financial records: bank account number, credit card data, transaction history, tax filings
- Employment data: employee ID, performance reviews, salary records, attendance logs
- Location data: GPS coordinates from a mobile device, travel card records, cell tower logs
- Physical characteristics: photographs, video surveillance footage, voice recordings
- Opinions and assessments: a doctor’s diagnosis, a teacher’s evaluation, a credit score
None of these items has to include someone’s name to qualify. A dataset of anonymous purchase histories becomes personal data the moment it can be cross-referenced with loyalty card records or delivery addresses to identify buyers.
Special Categories Under Article 9
Article 9 carves out a subset of personal data that receives extra protection because misuse could cause serious harm. Processing this data is prohibited by default, with only narrow exceptions.6General Data Protection Regulation (GDPR). Art. 9 GDPR Processing of Special Categories of Personal Data
The protected categories are:
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic data: information from biological samples that reveals inherited or acquired characteristics about a person’s health or physiology
- Biometric data: fingerprints, facial recognition templates, iris scans, or other physical measurements used to identify someone
- Health data: any information about a person’s physical or mental health, including records of healthcare services they have received
- Sex life or sexual orientation
The word “revealing” in Article 9 matters. Data does not have to explicitly state someone’s religion or ethnicity to fall into a special category. A dietary preference recorded by a catering service could reveal religious beliefs. A fitness tracker log could reveal a health condition. If data has the potential to expose sensitive traits, even indirectly, the stricter rules apply.1General Data Protection Regulation (GDPR). Art. 4 GDPR Definitions
To process special category data lawfully, an organization needs both a lawful basis under Article 6 and a separate exception under Article 9(2). Common exceptions include explicit consent, a legal obligation in employment or social security law, the protection of someone’s vital interests when they cannot consent, and processing for public health purposes.6General Data Protection Regulation (GDPR). Art. 9 GDPR Processing of Special Categories of Personal Data
Criminal Conviction Data Sits in Its Own Category
Article 10 creates a separate restrictive regime for data about criminal convictions and offenses. It is not grouped with the Article 9 special categories, but it gets its own layer of protection. Organizations can only process criminal records under the control of an official authority or when specifically authorized by EU or member state law that includes safeguards for the individual. Any comprehensive registry of criminal convictions must be maintained exclusively under official authority.7General Data Protection Regulation (GDPR). Art. 10 GDPR Processing of Personal Data Relating to Criminal Convictions and Offences
This matters for employers running background checks or landlords screening tenants. Unlike health or biometric data, where explicit consent can open the door, criminal conviction data requires a specific legal authorization. Consent alone is not enough in most member states.
Anonymized Data Falls Outside, Pseudonymized Data Does Not
Data escapes the regulation only through true anonymization, and the bar is high. Recital 26 states that data protection principles do not apply to information rendered anonymous “in such a manner that the data subject is not or no longer identifiable.” Stripping names is not enough. If patterns in the remaining data, combined with other available information, could lead back to a real person, the data is still personal.4General Data Protection Regulation (GDPR). Recital 26 – Not Applicable to Anonymous Data
The practical test asks whether a motivated person with access to other data sources and reasonable resources could re-identify individuals in the dataset. This is sometimes called the “motivated intruder” standard. Organizations should consider not just today’s technology but foreseeable developments. A dataset that is effectively anonymous today could become identifiable as linking tools improve or new public datasets appear.
Pseudonymization is a different, lesser step. It replaces direct identifiers with artificial keys or codes so the data cannot be tied to a specific person without access to separately stored mapping information. A hospital might replace patient names with reference numbers while keeping the lookup table in a locked system. Article 4(5) makes clear that pseudonymized data remains personal data because the link back to the individual still exists. The regulation encourages pseudonymization as a risk-reduction measure and treats it favorably when assessing compliance, but it does not exempt organizations from their obligations.1General Data Protection Regulation (GDPR). Art. 4 GDPR Definitions
Why the Classification Matters
Once information qualifies as personal data, the full weight of the regulation applies. The organization needs a lawful basis under Article 6 before processing begins, not retrofitted after a complaint.8General Data Protection Regulation (GDPR). Art. 6 GDPR Lawfulness of Processing The individual gains a set of enforceable rights, including access to a copy of their data, correction of errors, deletion in certain circumstances, portability, and the ability to object to certain uses.9General Data Protection Regulation (GDPR). Art. 15 GDPR Right of Access by the Data Subject An organization that processes data without recognizing it as personal risks missing response deadlines on those requests, which can itself trigger enforcement action carrying fines of up to €20 million or 4% of global annual turnover.10General Data Protection Regulation (GDPR). Art. 83 GDPR General Conditions for Imposing Administrative Fines The definition is the gate. Every other GDPR obligation opens from it.