Any information relating to an identified or identifiable living individual.
Personal data is any information relating to an identified or identifiable living person—names, identification numbers, location data, online identifiers, or factors specific to physical, physiological, genetic, mental, economic, cultural, or social identity. The definition is broad—if you can identify someone from the data, directly or indirectly, it's personal data. Special category data (race, health, religion, etc.) has additional protections. Understanding what constitutes personal data is fundamental to GDPR compliance.
Why It Matters
The DSC Perspective:
Identifying personal data in your systems is the first step to protection. The definition is broader than many expect—IP addresses, device IDs, and employee data all count. Know where your personal data is.