What type of data falls under GDPR?

The GDPR covers information relating to an identified or identifiable living person. Identification can be direct or possible through a combination of information.

Examples covered by the GDPR’s definition of personal data include:

• Names, addresses, personal email addresses and identification numbers.

• Financial details, employment records and purchase histories.

• Location data and online identifiers, including IP addresses and cookie IDs.

• Health records and other information about a person’s characteristics or activities.

Special categories, such as health data, religious beliefs and biometric data used for unique identification, receive additional protection. Criminal conviction data has separate safeguards. The GDPR covers automated processing and manual records held, or intended to be held, in a structured filing system. Publicly available personal data can still be protected; truly anonymised information falls outside its scope.