What data is not protected by GDPR?

GDPR generally does not cover information that falls outside its definition of personal data. Examples include:

• Anonymous data: Information that cannot identify an individual using means reasonably likely to be used, including in combination with other available information.

• Company-only information: Details about a legal entity, such as its company registration number, that do not identify a person.

• Non-personal information: Weather measurements or product specifications with no connection to identifiable individuals.

• Information solely about deceased people: GDPR itself does not apply, although national laws may provide protection.

Employee details and information identifying sole traders can still be personal data. Public availability, encryption or pseudonymisation does not automatically remove GDPR protection. Replacing someone’s name with a code is therefore different from making the information genuinely anonymous.