Personal data is any information that relates to an identified or identifiable natural person, meaning a living individual who can be singled out directly or indirectly from the information alone or in combination with other data. In privacy fundamentals, it is the threshold concept of data protection law: once information qualifies as personal data, rules on lawful processing, transparency, security and individual rights apply.
The definition is deliberately broad. It covers names and identification numbers, but also online identifiers, location data, device data, opinions about a person and inferences drawn from behavior. The decisive question is not what the data looks like but whether it can be linked to a person by any means reasonably likely to be used.
The four elements of the personal data definition
The legal definition used in the GDPR and in many laws modeled on it breaks down into four cumulative elements. Information is personal data only when all four are present, and each element is interpreted widely by regulators and courts.
| Element | Meaning | Practical interpretation |
|---|---|---|
| Any information | Content of any kind and format | Facts, opinions, images, audio, logs and assessments all count |
| Relating to | Link by content, purpose or effect | Data used to evaluate or affect a person relates to that person |
| Identified or identifiable | The person is known or can be singled out | Assessed against means reasonably likely to be used |
| Natural person | A living human being | Companies are excluded; deceased persons fall outside most regimes |
The element “relating to” is often underestimated. A performance score, a fraud risk rating or a delivery route can relate to an individual because it is used to evaluate or influence that individual, even when the record is stored under a technical key rather than a name.
How identifiability is assessed
Identifiability is a risk-based test, not a yes-or-no property of a field. A person is identifiable when the controller or another party could single them out using means reasonably likely to be used, considering cost, time, available technology and the state of the art at the moment of processing.
Three techniques drive identification in practice. Singling out isolates one record in a dataset; linkability connects records about the same person across datasets; inference deduces an attribute with significant probability. Combinations of ordinary attributes such as postal code, birth date and gender are well known to make a large share of individuals unique.
| Identifier type | Examples | Why it can identify |
|---|---|---|
| Direct identifiers | Name, passport number, face image | Point to one person without extra data |
| Online identifiers | IP address, cookie ID, advertising ID | Allow singling out and linking across sessions |
| Quasi-identifiers | Postal code, birth date, job title | Unique in combination with each other |
| Behavioral data | Location trails, purchase history | Patterns are highly distinctive per person |
| Derived data | Segments, scores, predictions | Attached to an individual profile |
Dynamic IP addresses illustrate the test well. A website operator cannot name the visitor on its own, yet European case law has treated such addresses as personal data where the operator has legal means to obtain the subscriber identity from the access provider.
Special categories and other sensitive data
Within personal data, some types carry elevated risk to fundamental rights and receive stricter treatment. Processing them is prohibited by default unless a specific condition applies, such as explicit consent or a legal obligation in employment or public health.
| Category | Examples | Additional requirement |
|---|---|---|
| Special category data | Health, biometric, genetic, religious, sexual orientation data | Lawful basis plus a specific exemption condition |
| Criminal offense data | Convictions, offences, related security measures | Official authority or specific legal authorization |
| Children’s data | Profiles and accounts of minors | Age-appropriate consent and design safeguards |
| National identifiers | National ID or social security numbers | Conditions set by national law |
Inferred sensitive data counts as well. A model that infers a probable pregnancy or a health condition from shopping behavior is processing special category data, regardless of whether the person ever disclosed it.
Personal data compared with neighboring concepts
Personal data is frequently confused with PII, a term used mainly in United States frameworks. The difference matters in multinational programs because the scope of protection differs, and a dataset outside one definition can fall squarely inside the other.
| Term | Typical framework | Scope compared with personal data |
|---|---|---|
| Personal data | GDPR and similar laws | Broadest; any identifiable information |
| PII | United States sectoral rules | Often a narrower list of identifying fields |
| Pseudonymized data | GDPR | Still personal data; identifiers replaced but re-linkable |
| Anonymous data | GDPR recital on anonymity | Outside scope; no reasonable re-identification |
| Non-personal data | Industrial and machine data | Outside scope unless linked to a person |
The obligations attached to personal data fall on the data controller, which decides purposes and means, and on the data processor, which acts on instructions. The principle of data minimization then limits how much personal data either may collect and keep.
Common mistakes in classifying personal data
Misclassification is one of the most frequent root causes of compliance gaps, because data treated as non-personal escapes retention limits, access controls and transparency notices.
- Treating hashed email addresses as anonymous, although the same hash links the person across systems.
- Assuming business contact details of employees are outside scope; they identify natural persons.
- Ignoring free-text fields and support tickets, which often contain names, health details or account numbers.
- Classifying telemetry and logs as technical data while they carry device IDs and IP addresses.
- Believing that publicly available data is free to reuse; public availability does not remove protection.
A reliable approach is to build a data inventory that records, per field, whether it is a direct identifier, a quasi-identifier or neither, and to reassess the classification whenever datasets are combined or enriched.
A non-technical view
Personal data is anything that can point back to you. Your name obviously does, but so does your phone number, your home location at night, the ID your phone uses for ads or a note a doctor writes about you.
Think of it like a puzzle. One piece, such as your birth date, may not reveal who you are. Put a few pieces together and the picture becomes clear. That is why the law protects not only names but every piece that could help complete the picture. The key takeaway: if information can reasonably be connected to a real, living person, it deserves care.
A concrete example
An online retailer plans to share a “non-personal” analytics export with a marketing agency. The file contains no names, only a customer number, postal code, birth year, order history and the IP address of each session.
During review, the privacy team flags that every column can identify or link a customer: the customer number maps to the account database, the IP address is an online identifier, and postal code plus birth year narrows many records to a single person. The export is therefore personal data, so the retailer signs a processing agreement with the agency, removes the IP addresses and customer numbers, and generalizes birth year into ten-year bands.
The outcome is an export that still supports segment-level analysis while carrying far less re-identification risk, and the sharing now rests on a documented lawful basis instead of a mistaken assumption.