What qualifies as personal data under GDPR?

Personal data is information relating to a living person who can be identified directly or indirectly. Identification may be possible from a single detail or by combining information from different sources.

Examples include:

• Names, personal or identifiable work email addresses, telephone numbers and home addresses.

• Identification numbers, customer records and financial information.

• Online identifiers, such as IP addresses, cookie IDs and device identifiers that can be linked to individuals.

• Location records, photographs and recordings relating to identifiable people.

• Health records, genetic information and other special category data subject to additional safeguards.

A person’s name does not have to appear in the dataset. Pseudonymised data, such as records labelled with reference numbers, can still qualify as personal data where re-identification is reasonably possible.