What is personal data, and when does it stop being personal data?

In brief

Personal data is any information that relates to an identified or identifiable natural person. It can identify a person directly, such as by name, or indirectly, such as through a work role, location data, an online identifier or a combination of details. Special categories of personal data are more sensitive types, such as health data, biometric data used for unique identification, trade union membership and data revealing political opinions or religion. Data stops being personal data only when a person can no longer be identified from it, directly or indirectly.

Personal data exists when information can lead to a person

The General Data Protection Regulation's Article 4 defines personal data through the person it can lead to. The person is a natural person, which means a living human being. A municipality, a company or a department is not a natural person, but a named employee, customer, student or patient is, and a sole trader's business identifier can be personal data because it leads to one person.

The practical test is simple. If the information points to a person, or can be combined with other information so that it points to a person, it is personal data.

Common examples at work include:

• a name;
• a personal identity number;
• an employee number;
• a customer number;
• location data;
• online identifiers;
• a photograph where a person can be identified;
• a job title combined with a small team;
• notes that describe a person's work performance, health, finances or behaviour.

A single detail may be enough. A name on its own often identifies a person in a workplace system. Sometimes the risk comes from a combination. For example, “the only payroll specialist in the northern office who was absent last week” may identify a person even without a name.

The same article also defines processing. In everyday language, processing means almost anything done with personal data. It includes collecting, recording, organising, storing, changing, searching, using, disclosing, combining, restricting, erasing and destroying data. So a data protection question does not start only when data is sent outside the organisation. It can start when an employee opens, searches or stores the data.

Special categories of personal data are sensitive data handled only under exceptions

Some personal data receives stricter protection because misuse can affect a person in a serious way. The General Data Protection Regulation's Article 9 lists these special categories and starts from a prohibition on processing them. Processing is allowed only where one of the Article 9 exceptions applies.

Special categories include data that reveals or concerns:

Special category	Everyday example
Racial or ethnic origin	A record that states a person's ethnic background
Political opinions	A note about a person's political view
Religious or philosophical beliefs	Membership data for a religious community
Trade union membership	Payroll information showing union membership fees
Genetic data	Information from analysis of a biological sample
Biometric data used for unique identification	Fingerprint data used to identify a person
Health data	Sickness absence details or occupational health information
Sex life or sexual orientation	Case notes containing this information

Article 9 also gives exceptions. These include explicit consent for one or more specified purposes, employment and social security obligations and rights where allowed by law or a collective agreement, vital interests where the person cannot give consent, legal claims, substantial public interest based on law, health and social care purposes, public health reasons, and archiving, research or statistical purposes under the conditions stated in the regulation.

This matters in normal work. A supervisor may see a doctor's certificate, a human resources employee may handle absence information, and a service provider may process health-related customer data. These are not ordinary records. The organisation needs both a lawful basis under the General Data Protection Regulation's Article 6 and a special category exception under Article 9.

For employee data in particular, the boundary is easy to miss. A general HR note can become health data if it records a diagnosis, treatment, work ability or other information about physical or mental health. A wider discussion of employee data continues in A supervisor's data protection duty: what may be collected, viewed and asked about an employee.

Pseudonymisation reduces identification, but it usually does not remove personal data status

A technical term is easier to understand through an everyday example. Suppose a spreadsheet replaces each customer name with a code, such as C-1047. A separate file links C-1047 to the customer name. The first spreadsheet is harder to use for identification, but the link still exists.

That is pseudonymisation. The General Data Protection Regulation's Article 4 describes it as processing personal data so that the data can no longer be attributed to a specific data subject without additional information, provided that the additional information is kept separately and protected by technical and organisational measures.

In work terms, pseudonymisation is a safeguard. It reduces the chance that a person is identified by everyone who sees the data. It can also be relevant when a controller assesses whether later use of data is compatible with the original purpose under the General Data Protection Regulation's Article 6.

But pseudonymised data is usually still personal data. If someone can use the separate key or other additional information to identify the person, the person remains identifiable. The General Data Protection Regulation's Article 4 therefore still matters, and the organisation still needs the normal data protection controls.

Data stops being personal data only when the person can no longer be identified

Data stops being personal data only when it no longer relates to an identified or identifiable natural person. The General Data Protection Regulation's Article 4 gives the identification test. Identification can be direct or indirect. It can happen through a name, personal identity number, location data, online identifier or one or more factors specific to the person's physical, physiological, genetic, mental, economic, cultural or social identity.

This means removal of names is not always enough. If the remaining data still singles out a person, or can be combined with other information to single out a person, it remains personal data.

Examples at work:

• A customer list with names removed may still identify people if it includes rare combinations of postcode, age, service history and dates.
• A small-team absence report may identify the absent employee even without the employee's name.
• A log file may identify a user through an online identifier if the organisation can link that identifier to a person.
• A statistics table may stop pointing to a person if the data no longer allows direct or indirect identification.

The General Data Protection Regulation's Article 5 also connects this boundary to storage. Personal data must be kept in a form that permits identification only for as long as necessary for the purposes of processing. Longer storage is possible for archiving in the public interest, scientific or historical research purposes or statistical purposes, if the regulation's required safeguards are in place.

So the question is not only technical. It is also a purpose question. If the organisation still needs identifiable data for a lawful purpose, it may keep it within that purpose. If identifiable form is no longer necessary, the organisation needs to consider erasure, restriction, or a form where the person can no longer be identified.

Why recognising the boundary affects the whole data protection work

The definition decides when the General Data Protection Regulation's duties begin. If the data is personal data, the organisation needs a lawful basis under Article 6. A controller is the party that decides why and how personal data is processed. The controller must also follow the Article 5 principles, including lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

The definition also affects what employees must notice in daily work. An email attachment, a support ticket, a spreadsheet export or a chat message can contain personal data even when it does not look like a formal register. Article 4 defines a register broadly as a structured set of personal data accessible by specific criteria, whether centralised, decentralised or divided by function or geography.

Once data is personal data, people can exercise rights under Articles 12–20. These include access, rectification, erasure, restriction and data portability in the situations described in those articles. Article 12 also sets a response rule for requests under Articles 15–22: the controller must provide information on action taken without undue delay and in any event within one month of receiving the request. The period may be extended by up to two months where necessary because of complexity and number of requests, with notice within one month.

The same boundary matters when something goes wrong. Article 4 defines a personal data breach as a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Under the General Data Protection Regulation's Article 33, the controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to natural persons' rights and freedoms. A processor must notify the controller without undue delay after becoming aware of the breach. The practical timing question continues in Personal data breach: the 72 hours start when an employee notices.

What the definition does not decide on its own

Recognising personal data is the start, not the end.

First, the definition does not give permission to process the data. The organisation still needs a lawful basis under the General Data Protection Regulation's Article 6. The listed bases include consent, contract, legal obligation, vital interests, a task in the public interest or exercise of official authority, and legitimate interests. Article 6 also says that the legitimate interests basis does not apply to processing carried out by public authorities in the performance of their tasks.

Second, the definition does not make special category data lawful to process. If Article 9 data is involved, the organisation needs an Article 9 exception in addition to an Article 6 lawful basis.

Third, public availability does not remove the personal data character. If information relates to an identified or identifiable person, it is personal data. Article 9 has an exception for special category data that the data subject has manifestly made public, but that is an exception to the Article 9 prohibition. It is not a general rule that public data can be used freely.

Fourth, pseudonymisation does not automatically end data protection duties. It is a safeguard, not a magic eraser. If the person can still be identified with additional information, the data remains personal data.

Fifth, the definition does not set one universal retention period. Article 5 requires identifiable form only as long as necessary for the purposes. Articles 13 and 14 require the controller to provide the retention period or, if that is not possible, the criteria used to determine it when giving privacy information.

Decision-maker checklist for recognising personal data

A decision-maker does not need to inspect every record personally. But the organisation needs a shared method that employees can apply before they collect, share, store or delete data.

Use this checklist when assessing a dataset, system or work process:

• Does the information relate to a living person?
• Is the person named or otherwise directly identified?
• Can the person be identified indirectly from codes, identifiers, location data, role, time, event details or other clues?
• Can another team, supplier or system combine the data with additional information and identify the person?
• Does the data include special categories under Article 9, such as health data, biometric identification data or trade union membership?
• Has the purpose of processing been defined clearly?
• Is there a lawful basis under Article 6?
• If special category data is involved, is there also an Article 9 exception?
• Is the amount of data limited to what is necessary for the purpose?
• Is identifiable form needed for the whole retention period, or can identification be reduced earlier?
• If the data is pseudonymised, who holds the additional information and how is it protected?
• If a person asks for access, correction or erasure, can the organisation recognise the request and route it within the Article 12 time rule?
• If the data is lost, disclosed to the wrong person or accessed without permission, can employees recognise that it may be a personal data breach?

This boundary is a daily competence issue. If employees can identify personal data, special category data and pseudonymised data, they can also recognise when the GDPR's principles, lawful bases, rights and breach duties are triggered. For a broader staff-level view, see What data protection skills does every employee need?.