What is personal data?
Definition
Personal data is any information about a living person who can be identified from it, directly or indirectly, such as a name, an address, an ID number, location data or an online identifier like an IP address.
- Category
- Data
- Also called
- personal information, personal data definition
- Last updated
The UK's data protection regulator, the ICO, explains that under the UK GDPR personal data means information relating to an identifiable living person. The EU GDPR uses almost the same wording. Two tests matter: the information has to be about a person, and that person has to be identifiable.
What counts
Identifiers named in the law include a name, an identification number, location data and an online identifier. In practice that covers your email address, phone number, home address, account numbers, photos, and device identifiers such as IP addresses and cookie IDs. It also covers opinions and inferences about you, for example a record that says you are likely to be interested in a product.
Identifiable doesn't have to mean named. If someone could work out who you are by combining a postcode, a job title and a birth year, that combination is personal data too.
What doesn't count
According to the ICO, information about a deceased person, information about a company, and data that has been properly anonymised are outside the UK GDPR. Pseudonymised data, where names are swapped for codes but the key still exists somewhere, remains personal data.
Personal data vs. related terms
Personal data is the broad category. Sensitive data, which the UK GDPR calls special category data, is a narrower group such as health or religious beliefs that gets stronger protection. In US usage you will see "PII" for a similar idea, but the legal definitions differ.
Australia's Privacy Act uses the phrase "personal information" for the same concept; this entry follows the UK GDPR wording.
Why it matters to you
Anything that counts as personal data can be collected, sold and combined by companies. Data brokers build profiles from exactly these pieces. Knowing what counts helps you see how much of you is out there, and it is the starting point for your rights to see, correct or delete it.
How to protect yourself
- 1
Share fewer identifiers
Give out only what a form needs. A separate email address or phone number for sign-ups keeps your main ones out of broker databases.
- 2
Use your access and deletion rights
Under UK and EU GDPR you can ask a company what personal data it holds on you and ask for it to be erased. Send the request in writing to the company's data protection contact.
- 3
Remove your listings from data brokers
Brokers combine your name, address, phone number and relatives into one profile. Serus finds where your address and phone number are listed on data brokers and people-search sites and removes them for you. Our data broker guides cover the manual route.
- 4
Check app permissions and cookie choices
Reject non-essential cookies and turn off location, contacts and ad tracking for apps that don't need them.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is an example of personal data?
A name, a home address, an email address, a phone number, an IP address, a photo or an account number. Anything that points to you, alone or combined with other information.
Is an IP address personal data?
Under the UK GDPR, online identifiers such as IP addresses can be personal data when they can be linked to a person.
What is the difference between personal data and sensitive data?
Personal data is any information about an identifiable person. Sensitive data, called special category data in the UK GDPR, is a narrower group like health or religion that needs extra protection.
Is anonymous data personal data?
Properly anonymised data is not. Pseudonymised data, where a key still links it back to you, still is.
Sources
Something wrong or out of date? Tell us and we'll re-check it.