Personal data under GDPR is any information relating to an identified or identifiable natural person. This definition, set out in Art. 4(1) GDPR — the first of the 26 definitions listed in GDPR Article 4 — is the starting point for deciding which activities fall within data protection law. Finding personal data does not make every GDPR article applicable: material and territorial scope, the organisation’s role and the particular processing determine its obligations.
Key Takeaways
- Art. 4(1) GDPR defines personal data as “any information relating to an identified or identifiable natural person” — the scope is deliberately broad.
- Personal data includes obvious identifiers (names, emails) and indirect identifiers (IP addresses, cookie IDs, location data) that can identify someone in combination.
- Removing names is not enough. Assess whether a person can be identified using means reasonably likely to be used, including available additional information.
- Special categories (Art. 9) — health, biometric data used to uniquely identify a person, genetic data, racial origin, political opinions, religious beliefs, sex life — require enhanced protection and an Art. 9(2) legal basis.
- The September 2025 CJEU ruling in EDPS v SRB (C-413/23 P) clarified that pseudonymised data is not automatically personal data for every recipient — only when re-identification is “reasonably likely.”
How Art. 4(1) GDPR Defines Personal Data
The GDPR defines personal data broadly:
“‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.” — Art. 4(1) GDPR
The definition contains four cumulative elements:
-
“Any information” — The scope is deliberately broad. It covers objective data (date of birth, address) and subjective data (opinions, assessments). The CJEU confirmed in EDPS v SRB (2025) that personal opinions are inherently linked to their authors and constitute personal data by their very nature.
-
“Relating to” — The information must concern the individual, whether by content, purpose, or effect. A medical report relates to the patient by content. CCTV footage of an employee relates to them by purpose (monitoring). A credit score relates to the individual by effect (determines their access to finance).
-
“Identified or identifiable” — A person is identified when they are distinguished from all others within a group. They are identifiable when identification is possible — directly or indirectly — by combining available data points.
-
“Natural person” — The GDPR protects natural persons. Company information can still relate to an individual, such as a sole trader or named employee. Recital 27 excludes deceased persons but allows Member States to provide rules for their data; records may also identify living relatives.
Categories of Personal Data GDPR
Personal data GDPR covers a vast range of information. The key is not whether the data seems sensitive, but whether it can identify a person.
Direct Identifiers
These identify an individual on their own:
- Full name (first name + last name)
- National identification or social security number
- Passport number
- Photograph of a face
- Fingerprint or other biometric data
Indirect Identifiers
These identify someone when combined with other available information:
- IP address — The CJEU ruled in Breyer v Germany (C-582/14, October 2016) that even dynamic IP addresses constitute personal data when the controller has legal means to obtain additional identification information from the ISP.
- Cookie identifiers and device fingerprints — tracking technologies that create unique profiles
- Location data (GPS coordinates, cell tower data, Wi-Fi connection logs)
- Email address — especially corporate addresses containing a name (john.smith@company.com)
- Employee ID numbers paired with organisational directories
- Vehicle licence plates combined with registration databases
Professional and Behavioural Data
- CVs, LinkedIn profiles, professional qualifications
- Employee records, payroll data, performance reviews
- Purchase history and browsing behaviour
- Voice recordings (customer service calls)
- Keystroke patterns and usage analytics
Key distinction: Personal data is not the same as private data. A person’s name on a public business directory is personal data under GDPR, even though it is not private. The legal definition covers any data that enables identification, regardless of whether the person considers it intimate or confidential. For the broader relationship between privacy and data protection online, see our cyber privacy definition guide.
For a detailed analysis of whether IP addresses constitute personal data, see our dedicated guide.
What Is Not Personal Data: Anonymisation vs Pseudonymisation
Understanding this distinction is critical because it determines whether the GDPR applies at all.
Anonymous Data
Anonymised data falls entirely outside GDPR scope. Recital 26 states that the regulation “does not concern the processing of anonymous information, including for statistical or research purposes.” Data is anonymous only when re-identification is no longer “reasonably likely” considering all means, costs, and technology available.
True anonymisation is difficult to achieve. Simply removing names is rarely sufficient — combinations of age, location, and profession can re-identify individuals in datasets. The Article 29 Working Party’s Opinion 05/2014 on Anonymisation Techniques remains the primary reference, identifying three risks: singling out, linkability, and inference.
Pseudonymised Data
Pseudonymisation is a safeguard, not an automatic exit from GDPR. Replacing identifiers with codes while retaining a separate key normally leaves the originating controller able to identify people. It may reduce risks and support data minimisation, but the controller must still justify its processing and protect the key.
The EDPB published Guidelines 01/2025 on Pseudonymisation for consultation in January 2025. Its newer Guidelines 02/2026 on Anonymisation are also a consultation version, with feedback open until 30 October 2026. Treat draft guidance as draft when documenting an assessment; the legal definition and CJEU rulings remain the starting points.
The 2025 CJEU Ruling: EDPS v SRB (C-413/23 P)
On 4 September 2025, the CJEU clarified the treatment of pseudonymised comments shared by the Single Resolution Board with Deloitte. The case concerned Regulation 2018/1725, the EU institutions’ data protection regime. The Court’s explanation confirms that identifiability can differ between recipients: pseudonymisation may prevent another entity from identifying people, depending on the available means.
The judgment also preserves an important controller obligation. The SRB’s duty to inform people had to be assessed from its perspective when it collected the information. A later recipient’s inability to identify them did not remove that duty. The Court set aside the General Court judgment and referred the case back.
Do not infer that stripping names automatically removes the need for an Article 28 agreement. First assess the actual service, the recipient’s role and its identification capabilities. Separately assess the originating controller’s lawful disclosure and transparency duties.
A Classification Record for a Customer Dataset
For a proposed analytics export, record the decision field by field rather than labelling the entire file “anonymous”:
| Export field or feature | Question to resolve | Evidence to retain |
|---|---|---|
| Random customer token | Can the recipient access a key or join another dataset? | Access design, contracts and available matching datasets |
| Exact transaction timestamp and postcode | Could rare combinations single out a customer? | Small-group analysis and the effect of coarsening fields |
| Free-text support note | Does the note name people or reveal health information? | Redaction process and a sample validation |
| Repeated exports | Can successive versions reveal facts absent from one file? | Release history and a combined-data assessment |
A possible result is to remove free text, aggregate rare transactions and restrict the remaining export while the assessment is completed. Record whose perspective was examined and what new information would reopen the decision. If the file remains personal data, carry its classification into the processing record, retention decision and recipient contract. Anonymising a personal dataset is itself processing that requires a lawful basis.
Special Categories of Personal Data (Art. 9)
Art. 9 GDPR defines certain types of personal data as “special categories” that require enhanced protection. Processing these categories is prohibited by default, with limited exceptions under Art. 9(2):
| Special Category | Examples |
|---|---|
| Racial or ethnic origin | Ethnic origin recorded in HR systems; nationality alone is not automatically special category data |
| Political opinions | Party membership, political donations |
| Religious or philosophical beliefs | Religious affiliation, dietary requirements indicating beliefs |
| Trade union membership | Union dues deducted from payroll |
| Genetic data | DNA test results, genetic predisposition data |
| Biometric data (for identification) | Fingerprints, facial recognition templates, iris scans |
| Health data | Medical records, sick leave data, disability status |
| Sex life or sexual orientation | Dating app profiles, medical records indicating orientation |
Processing special category data requires an Art. 6 legal basis as well as an applicable exception in Art. 9(2) — typically explicit consent (Art. 9(2)(a)), employment law obligations (Art. 9(2)(b)), or substantial public interest (Art. 9(2)(g)).
Criminal conviction data is governed separately under Art. 10 and may only be processed under the control of official authority or where authorised by Union or Member State law providing appropriate safeguards.
A Data Protection Officer is required under Art. 37(1)© where core activities consist of large-scale processing of special categories or criminal conviction/offence data; public authorities and the separate monitoring criterion must also be considered.
What Happens When You Process Personal Data
Once an organisation determines that it processes personal data GDPR, identify the applicable obligations, including:
- Record of processing activities (Art. 30) — document applicable controller or processor records, considering the narrow Art. 30(5) exemption. Legal basis is useful accountability information, although it is not an express field in Art. 30(1).
- Legal basis — each processing activity must rely on one of the six legal bases in Art. 6: consent, contract, legal obligation, vital interests, public task, or legitimate interests.
- Data subject rights — individuals have the right to access, rectify, erase, restrict, and port their personal data.
- Security measures — appropriate technical and organisational measures must protect the data (Art. 32).
- Breach notification — controllers notify the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to people (Art. 33).
- Data accuracy — Art. 5(1)(d) requires that personal data be accurate and kept up to date. For implementation guidance, see our article on data accuracy under GDPR.
FAQ
What counts as personal data under GDPR?
Art. 4(1) GDPR defines personal data as any information relating to an identified or identifiable natural person. This includes names, email addresses, IP addresses (per the Breyer ruling), location data, cookie identifiers, and any combination of data that can identify someone indirectly. The scope is deliberately broad — if in doubt, treat it as personal data.
Is pseudonymised data still personal data under GDPR?
Yes, for the controller who holds the re-identification key. The September 2025 CJEU ruling in EDPS v SRB (C-413/23 P) clarified that pseudonymised data is not automatically personal data for every recipient — only when re-identification is “reasonably likely” for the specific entity holding the data. Only truly anonymous data falls outside GDPR scope entirely.
Does GDPR apply to business contact data?
Generally yes. An individual’s work email address (john.smith@company.com) is personal data because it identifies a specific person. A generic address (info@company.com) may be outside the definition on its own, but can become personal data when linked to a named user, sole trader or message history. B2B contact databases containing individual names, direct phone numbers, or professional titles linked to identifiable individuals are subject to GDPR.
What is sensitive personal data (special category data) under GDPR?
Art. 9 lists special categories: health data, biometric data used for unique identification, genetic data, racial/ethnic origin, political opinions, religious beliefs, trade union membership, and data concerning sex life or sexual orientation. Processing requires explicit consent or another Art. 9(2) legal basis. Criminal conviction data under Art. 10 has separate restrictions. Violations involving special categories carry higher penalties.
Conclusion
Classify information in its actual processing context. Record what identifies people, who can obtain additional information, and whether special-category rules apply. Keep the originating controller’s obligations separate from any recipient-specific anonymity assessment, and review the decision when datasets, access or available technology change.