Why this question comes first
Almost every privacy rule begins with a definition. Rights to see or delete information, duties to protect it, and rules about sharing it apply only to information that counts as “personal.” If something falls outside the definition, many of those rules do not apply at all. That makes the definition one of the most consequential pieces of text in privacy law, and it is why the same piece of information can be treated differently from one place to the next.
This article is general information, not legal advice.
The common core
Most definitions share a central idea: personal data is information that relates to a person who can be identified. Under the European Union’s General Data Protection Regulation, for example, personal data means any information relating to an identified or identifiable natural person. “Identifiable” matters: you do not have to be named for information to be about you if someone could work out who you are, directly or indirectly.
Obvious examples include a name, a home address, an email address that contains a name, a government identification number and a photo that shows a face. Less obvious examples may also qualify, depending on the context:
- An online identifier such as an IP address or a device or advertising ID
- Location data
- A cookie identifier, as discussed in the article on online tracking
- A voice recording or video of a person
- Employment or education records
- A customer number tied to purchase history
- Biometric data, such as a fingerprint or face template
- Opinions about a person, such as a performance review
The test is generally about whether the information can be linked to an individual, by the organization holding it or by others who might reasonably combine it with other data.
Directly and indirectly identifying information
A single detail may not identify anyone, but a combination can. A postal code, a birth date and a gender may each be shared by many people, yet together they can narrow things down to a very small group, sometimes one person. This is why regulators and researchers talk about “indirect identifiers” and why removing names from a dataset does not always make it anonymous.
Context matters too. A job title like “mayor of a small town” can point to one person, while the same title in a large company may not. Information that looks harmless in isolation may become identifying once matched with other sources.
Different labels, different consequences
Several terms are used, and they are easy to confuse.
- Identified or directly identifiable data. Information clearly tied to a person. It is covered by privacy rules in nearly all frameworks.
- Pseudonymized data. Direct identifiers are replaced with codes, and the key to link them back is kept separately. This reduces risk but, under frameworks like the GDPR, the data is still considered personal because re-identification remains possible with the key.
- De-identified data. A term used differently in different places. In some contexts it means identifiers have been removed, with legal conditions such as commitments not to re-identify.
- Anonymized data. Information altered so that people can no longer reasonably be identified. Truly anonymous data is generally outside personal data rules, but the bar is high, and in practice, claims of anonymity are sometimes wrong. Researchers have repeatedly shown that supposedly anonymous datasets can be re-identified by combining them with other information.
- Aggregated data. Statistics about groups, such as the number of visitors per day. Usually not personal if no individual can be singled out, though very small groups can be a problem.
The practical result: an organization that describes its data as “anonymous” may be making a legal and technical claim that deserves scrutiny.
Sensitive categories
Many laws single out categories of data that carry higher risk of harm if misused and give them stronger protection. Lists vary but often include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or orientation, genetic data and biometric data used for identification, with others such as precise location, financial account details or children’s data protected in some places. The reasoning is that exposure or misuse could lead to discrimination, safety risks or serious embarrassment. Using such data often requires an additional legal basis, such as explicit consent, or additional safeguards.
Sensitivity can also come from inference. A pattern of purchases or browsing might let an analyst guess at health or other private matters without ever collecting them directly. Whether inferred information is treated as sensitive varies and is debated.
How definitions differ around the world
Because there is no single global standard, the definitions differ in scope and wording.
- Broad, general definitions. The European approach covers any information relating to an identifiable person, regardless of sector.
- Sector-specific approaches. The United States has historically regulated by sector, so health, financial, education and children’s data each have separate rules and their own definitions, alongside a growing number of state privacy laws with their own wording, which commonly cover information that identifies, relates to or could reasonably be linked to a particular consumer or household.
- Terms such as “personally identifiable information.” Used widely, especially in the United States and in security contexts, and typically a narrower idea than the European “personal data,” often focused on items like names and numbers.
- Other exclusions. Some laws exempt employee data, publicly available information, or data handled by certain bodies, and some apply special rules for pseudonymous data.
The differences mean that something like a device identifier might be personal data in one framework and not in another, or that the rules for public records vary. Organizations operating across borders typically look at the most demanding definition they are subject to.
Why definitions matter in practice
For individuals, the definition determines whether you have rights to see your data, correct it, ask for erasure or be notified when it is exposed. If a company’s data is considered anonymous, those rights may not apply to it.
For organizations, it determines the scope of work: which systems hold covered data, what notices are needed, how long it can be kept, how it must be secured and whether a breach has to be reported. Mapping what personal data you hold is often the first step of a data governance effort, and understanding the definition helps decide what to collect in the first place.
For technology. Newer systems blur the lines. Image and voice datasets used for facial recognition, or the large collections of text used to build language models, can contain personal data even when it was never meant to be collected. Questions about AI privacy and about what counts as personal data inside a trained model are still being worked through.
Common misunderstandings
- “If it is public, it is not personal.” Public availability does not always take information outside privacy rules, although some laws treat publicly available data differently.
- “No name, no personal data.” Identifiers other than names can be enough.
- “Hashing makes it anonymous.” Converting an email address into a scrambled code may still allow matching and re-identification, so hashed identifiers are often still treated as personal.
- “Business contact details are not personal.” In many frameworks, a work email address that includes a person’s name is still personal data.
- “Anonymous once, anonymous always.” Re-identification becomes easier as more data becomes available.
Takeaway
Personal data is not just names and numbers. In most modern definitions it is any information that can reasonably be linked to a specific person, with extra care for sensitive categories. Because definitions differ by place and sector, anyone handling such information should check the rules that apply to them with qualified professionals, and individuals can use the privacy notices and settings of the services they use to understand what is collected about them.