What is personal data under GDPR?

Personal data is any information relating to an identified or identifiable living person. Under Article 4(1), identification can be direct, such as through a name, or indirect, by combining information.

Examples include email addresses, identification numbers, bank details, photographs, location data and online identifiers such as IP addresses or cookie IDs. Purchase histories, opinions and assessments also qualify when they relate to an identifiable person. Sensitive data, such as health information or religious beliefs, receives additional protection.

Public availability does not remove GDPR protection. Replacing names with codes or encrypting records does not make them anonymous where identification remains reasonably possible. Truly anonymised data, from which a person is no longer identifiable using reasonably likely means, falls outside GDPR.