Personal Data
Any information that relates to an identified or identifiable natural person.
Full Definition
Personal Data is any information that relates to a natural person who can be identified — directly or indirectly — by reference to that data. GDPR provides an expansive definition that includes obvious identifiers (name, ID number, location data) as well as online identifiers (IP addresses, cookie IDs) and factors specific to an individual's physical, physiological, genetic, mental, economic, cultural, or social identity. India's DPDP Act defines personal data as 'any data about an individual who is identifiable by or in relation to such data'. The key question is always whether the data, alone or in combination, could identify a specific individual.
How each law treats it
Any information relating to an identified or identifiable natural person. The identifiability test includes direct identifiers, quasi-identifiers and 'means reasonably likely to be used'.
Any data about an individual who is identifiable by or in relation to such data. Digital personal data is the only in-scope category.
Information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.
In practice
- Treat IP addresses and cookie IDs as personal data by default. The CJEU has ruled on both.
- Pseudonymised data remains personal data. Anonymised data (irreversibly) does not.
- Household-level data is in CCPA scope but outside GDPR scope unless it can be linked to an individual.
Common pitfalls
- Dismissing device identifiers as 'not PII' — modern privacy law doesn't use the US PII concept, and device identifiers are in scope.
- Overlooking the 'identifiable' test. If you can combine the data with other reasonably-available information to identify a person, the data is in scope.
- Treating business-contact data as outside scope. The EDPB has consistently treated work emails as personal data.
Frequently asked questions
Is an IP address personal data?+
Yes under GDPR — the CJEU confirmed this in Breyer. Dynamic IPs are personal data in the hands of a controller that can reasonably obtain the identity. CCPA likewise treats IPs as personal information.
Is machine-generated telemetry personal data?+
If the telemetry can be linked to an identifiable individual (device fingerprint, user agent + IP), yes. Pure infrastructure telemetry not linkable to a person is out of scope.
What about publicly available data?+
Still personal data if it identifies a person. The CJEU and the EDPB have both rejected the 'public = free use' interpretation. CCPA has a specific 'publicly available information' exclusion for truthfully published government records.
Related terms
Sensitive Personal Data
Categories of personal data that warrant heightened protection due to the elevated risk of harm if misused.
Data Subject
An identified or identifiable natural person whose personal data is being processed.
Anonymisation
The irreversible process of altering data so that individuals can no longer be identified, directly or indirectly.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes