Privacy

Personal Data

Any information that can identify a living individual, directly or indirectly.

Personal data is any information relating to an identified or identifiable natural person (the "data subject"). A person is identifiable if they can be identified, directly or indirectly, by reference to an identifier.

What Counts as Personal Data?

  • Direct identifiers: Name, email address, phone number, photo
  • Indirect identifiers: IP address, cookie IDs, device fingerprints, location data
  • Combined data: Information that becomes identifying when combined with other data (e.g. "male, born 1990, works at Company X")

What Is NOT Personal Data?

  • Truly anonymous data that cannot be re-linked to an individual
  • Company or organisational data (e.g. a business address)
  • Data about deceased persons (in most jurisdictions)

Why It Matters

The classification of data as "personal" triggers the full weight of data protection law. Once data qualifies as personal data, the data controller must ensure a valid legal basis for processing it and respect all data subject rights.

Defined in GDPR Article 4(1).

Related Terms

Data ControllerPrivacy

The entity that determines the purposes and means of processing personal data.

Data SubjectPrivacy

The identified or identifiable person whose personal data is being processed.

PseudonymizationPrivacy

Processing personal data so it can no longer be attributed to a specific person without additional information kept separately.

AnonymizationPrivacy

The irreversible process of altering data so that individuals can no longer be identified, even indirectly.

GDPRLegal

The General Data Protection Regulation — the EU's comprehensive data protection law, effective since May 2018.

Persistent CookiePrivacy Impact Assessment