Personal data

Under Article 4(1) GDPR, personal data means any information relating to an identified or identifiable natural person. The concept is broad. It may cover a name, email address, customer number, location data, IP address, cookie identifier, photograph, application documents or information about a particular order. What matters is the link to a person, not the format of the information. A combination of individual details may also be personal data if it makes a person identifiable.

A person may be identifiable directly or indirectly. Identification does not depend on a name alone. The assessment considers the means that can reasonably be expected to be used, taking account of the available technology, the effort required and the circumstances. Pseudonymised data therefore remain personal data where additional information can be used to attribute them to a person. Information is outside the concept only once it has been anonymised so that the person is no longer identifiable.

The concept covers more than customer records. Employees, applicants, supplier contacts, website users and shareholders may all be data subjects. Information about a company as a legal entity is not personal data by itself. If it relates to a natural person, for example a sole trader or a managing director, the GDPR may apply again. Special categories such as health data or biometric data receive additional protection under Article 9 GDPR.

For a business, the first step is to identify which data in which processing activity can be linked to which person. That classification supports the next questions about purpose, legal basis, access, retention and responsibility. The privacy compliance and governance section provides the organisational context; the role check offers an initial orientation when another provider is involved.