What constitutes personal data?


The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.

This definition covers a wide range of personal identifiers to constitute personal data, including name, identification number, location data or online identifier, reflecting changes in technology and the way organisations collect information about people.

This means that these types of data will now be subject to fairness, lawfulness, security, data export and other data protection requirements just like every other type of ‘ordinary’ personal data.

Personal data that has been pseudonymised – for instance, hashed or encrypted – may also fall within the scope of the GDPR depending on how difficult it is to attribute the pseudonym to a particular individual.

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request