What Is Personal Data? GDPR Definition and Examples

Personal data is at the core of GDPR but what actually counts as personal data? We give a clear, practical definition.

Article 4(1) of the GDPR defines personal data as any information relating to an identified or identifiable natural person. Four elements make up that definition, each with its own significance: any information, relating to, identified or identifiable, and natural person.

The definition is deliberately wide. It covers a name and a salary, but also an IP address, a comment someone wrote in a survey, a photograph, a voice recording and a badge swipe at a door. If information can be connected to a living person, directly or through a detour, it's in scope.

A recent ruling has added an important nuance to how personal data is defined. On 4 September 2025, the Court of Justice of the European Union ruled in EDPS v SRB that the same dataset may qualify as personal data for one organisation but not for another, depending on whether the organisation can realistically identify the individuals behind it. That makes the question "is this personal data" partly a question about who's holding it.

Key takeaways

• Personal data is any information relating to an identified or identifiable living person, under Article 4(1).
• Identifiability includes indirect routes. If you can get to a person by combining the data with something else reasonably available, it counts.
• Special categories under Article 9 health, biometrics, political opinions, trade union membership and others carry stricter rules and a different legal basis.
• Pseudonymised data is usually personal data for whoever holds the key, and since September 2025 the Court has confirmed it may not be personal data for a recipient who cannot re-identify anyone.
• Anonymous data falls outside the GDPR entirely, but genuine anonymisation is harder to achieve than most organisations assume.

The definition, element by element

Any information. No restriction on format or accuracy. Objective facts, subjective assessments, numbers, free text, images, audio. A manager's written opinion that someone is difficult to work with is personal data about that employee the 2025 judgment confirmed that opinions are inseparable from the person who expressed them, and are personal data about that person too.

Relating to. The information has to be about the person, by content, purpose or effect. A car's service history is about the car, until it's used to assess the driver's behavior at which point it relates to a person.

Identified or identifiable. Identified is straightforward. Identifiable covers anyone you could single out using means reasonably likely to be used, by you or by someone else. Recital 26 sets that test, and it accounts for cost, time and available technology.

Natural person. Living individuals. Companies are out, deceased people are out under the GDPR itself though national law can extend protection, and in Denmark the Data Protection Act applies the rules to a deceased person's data for ten years after death.

Is it personal data?

The definition is easier to apply through cases than through theory.

Yes, it’s personal data

• Work email, such as firstname.lastname@company.com. It identifies a specific individual, even in a professional context.
• Cookie ID or advertising identifier. It’s an online identifier under Article 4(1), even without a name attached.
• CVR number of a sole trader. A one-person business identifies the person behind it.
• Pseudonymised dataset held by the controller. The controller holds the key and can re-identify.
• CCTV footage of an identifiable person. Images are personal data, and may also be biometric data if processed to identify someone.
• An employee’s performance assessment. It’s a subjective opinion about an identified person.

It depends

• Dynamic IP address held by a website operator. Usually yes. The CJEU held in Breyer (C-582/14) that it is, where legal means exist to obtain the subscriber’s identity.
• The same pseudonymised dataset at a recipient without the key. Possibly not. It’s assessed from that recipient’s realistic means, per EDPS v SRB.

No, it’s not personal data

• A company’s main switchboard number. It relates to a legal person, not an individual.
• Aggregated statistics, such as 400 employees in a survey. Nobody can be singled out, provided group sizes genuinely prevent it.

The pseudonymised dataset at a recipient is the case to notice. Before September 2025, most practitioners would have answered yes without hesitating.

Special categories and criminal data

Article 9 singles out data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, along with genetic data, biometric data processed to uniquely identify someone, health data, and data concerning sex life or sexual orientation.

Processing these is prohibited unless one of the Article 9(2) exceptions applies explicit consent, employment law obligations, vital interests, and a handful of others. That's a different structure from ordinary personal data, where you pick a legal basis under Article 6 and proceed.

Two traps recur. Data can reveal a special category without being labelled as one: a canteen registration for halal meals says something about religious belief, and a photograph can reveal ethnic origin. And biometric data only falls under Article 9 when it's processed for the purpose of unique identification a photograph is not automatically biometric data, but running it through facial recognition makes it so.

Criminal convictions and offences sit outside Article 9, in Article 10, with their own rule: processing requires official authority or authorisation under national law.

Pseudonymised, anonymous and the middle ground

These three terms get used loosely, and the distinction decides whether the GDPR applies at all.

Pseudonymisation replaces identifying details with a code, while the key that reverses it is kept separately. It's a security measure, encouraged by Article 32, and the data stays personal data for whoever can reverse it.

Anonymisation removes identifiability permanently, for everyone. Anonymous data is outside the GDPR. The bar is high: Recital 26 asks whether identification is possible by any means reasonably likely to be used, which rules out most datasets that have simply had the name column deleted.

The September 2025 judgment sharpened the middle ground. The Court held that pseudonymised data must not be regarded as personal data in all cases and for every person, and that identifiability should be assessed contextually, from the position of the party holding the data.

The ruling, however, is a narrower win than some interpretations and headlines suggest. The Court also held that the controller's transparency duty is assessed at the point of collection, so you can't avoid telling people about a transfer by pseudonymising first. And an assessment that a recipient cannot re-identify has to be documented and defensible, which is more work than treating everything as personal data. For most Nordic mid-market organisations the practical advice is unchanged: assume it's personal data unless you've done the analysis and written it down.

Why the definition decides your workload

Getting this right matters on a day-to-day basis, because nearly every GDPR obligation depends on it.

Your record of processing activities under Article 30 covers processing of personal data. Your retention schedules apply to personal data. The 72-hour breach notification clock under Article 33 starts when personal data is involved. Whether you need a DPIA depends on the data's nature. And the security of processing required by Article 32 scales with the risk the data poses to people.

Classify too narrowly and you have obligations you aren't meeting. Classify everything as personal data to be safe and you inflate the work encrypting, restricting and deleting things that never needed it. Both errors are expensive in different ways.

Processors add another layer. Any supplier that touches personal data on your behalf needs an Article 28 agreement, which means knowing which of your suppliers do and checking afterwards that they handle it the way the contract says.

Where to start

Whether youre starting from scratch or reviewing your existing GDPR documentation, here are some key areas to check:

• Your record of processing lists the categories of personal data per activity, not just the activity
• Special category data is flagged separately, with its Article 9(2) basis recorded
• Someone has checked whether anything you call anonymous would survive the Recital 26 test
• Decisions that a dataset is non-personal are written down with reasoning, not assumed
• Free text fields, survey comments and assessment notes are treated as personal data, because they are
• Retention periods are set per category, and reviewed on a fixed cycle
• Every supplier that touches personal data has an Article 28 agreement

Start with the free text. Structured fields usually get classified correctly, while comment boxes, internal notes and meeting minutes quietly accumulate personal data that nobody has mapped, retained deliberately or included in a deletion routine.

Cerivo's data protection platform brings your record of processing activities, data categories, legal bases, systems and data processor agreements together in one connected solution. This makes it easier to map and classify personal data, keep documentation up to date and maintain a clear overview of what data your organisation processes, where it goes and why.