What Counts as Personal Data Under GDPR?

What Counts as Personal Data Under GDPR

Here's the thing most lists of "personal data examples" miss: GDPR doesn't treat all personal data the same. There's regular personal data, and there's a stricter tier called "special category data" that needs extra justification just to process at all. Health information and biometric data — both common items on a typical list — aren't just "more sensitive examples." They're legally a different category with their own rules.

The Basic Definition

Personal data is any information that can identify a specific person, directly or indirectly. That's broader than people assume. It's not just names and emails — it includes:

• Names, email addresses, phone numbers

• ID numbers (national ID, tax ID, passport numbers)

• Location data and IP addresses

• Online identifiers like cookies and device IDs

• Financial data

• Any combination of data points that, put together, can identify someone

That last one matters more than it looks. A single data point might not identify anyone on its own, but stack enough of them together — browser type, rough location, login times, language preference — and suddenly you've got something that points to one specific person. GDPR treats that combination as personal data too, even though no individual piece would.

Special Category Data: A Stricter Tier

Article 9 carves out nine specific categories that get extra protection, because misusing them can lead to real discrimination or harm:

1. Racial or ethnic origin

2. Political opinions

3. Religious or philosophical beliefs

4. Trade union membership

5. Genetic data

6. Biometric data used to identify someone

7. Health data

8. Sex life information

9. Sexual orientation

Processing any of these is prohibited by default. You need a specific legal basis to do it at all — usually explicit consent, and GDPR sets a high bar for what counts as "explicit" here. It has to be a clear, specific statement about that exact category of data. Burying it in a general terms-and-conditions checkbox doesn't count.

The Part Almost Nobody Thinks About: Inferred Sensitive Data

Here's where it gets genuinely tricky. You don't have to directly collect someone's political opinions or religious beliefs for that data to count as special category data. If you can reasonably infer it from something else, that counts too.

Financial transaction data is the clearest example. A pattern of donations to a political party or a church reveals political or religious leaning, even if "political opinion" was never a field in your database. Regulators have made clear this kind of inference still counts as processing special category data — and it doesn't matter whether the inference is even accurate. If your system is effectively sorting people by likely religion or politics based on spending patterns, you're in Article 9 territory whether you meant to be or not.

Pseudonymization Isn't the Same as Anonymization

This mix-up causes real compliance problems. Pseudonymized data — where you've swapped out names for codes but kept a key somewhere to link back — is still personal data under GDPR. All the same rules apply. Genuinely anonymized data, where there's no way to ever link it back to a person, falls outside GDPR entirely.

A lot of companies think they've "anonymized" data when they've actually just pseudonymized it. If that re-identification key exists anywhere — even locked away and rarely used — GDPR still applies to that data.

Why Getting the Scope Right Matters

Misjudging what counts as personal data causes problems both ways. Treat something as personal data when it isn't, and you're adding unnecessary compliance overhead to data the law doesn't even reach. Miss that something actually is personal data — especially special category data hiding inside something that doesn't look sensitive, like spending patterns — and you've got a real, unaddressed gap that a regulator could flag.

Where This Connects to Other Frameworks

Getting your data inventory right here is foundational work that also pays off for ISO 27001 and SOC 2 — both expect you to know exactly what sensitive data you're holding and where it lives before you can build the right controls around it. Scope this once, well, and the other frameworks get easier to layer on top.

FAQs

What counts as personal data under GDPR? Personal data is any information that can identify a specific person, directly or indirectly. This includes names, email addresses, ID numbers, location data, IP addresses, online identifiers like cookies, financial data, and even combinations of smaller data points that together point to one specific individual.

What is "special category data" under GDPR, and how is it different from regular personal data? Special category data is a stricter tier defined in Article 9, covering nine categories — including racial/ethnic origin, political opinions, religious beliefs, genetic data, biometric data, health data, and sexual orientation. Unlike regular personal data, processing these categories is prohibited by default and requires a specific legal basis, usually explicit consent.

What qualifies as "explicit consent" for processing special category data? GDPR sets a high bar: it must be a clear, specific statement addressing that exact category of data. A general terms-and-conditions checkbox that bundles consent for multiple purposes does not meet this standard.

Can data become "special category data" even if it wasn't collected as such? Yes. If sensitive information can be reasonably inferred from other data — like political or religious leanings inferred from donation patterns — regulators treat that as processing special category data, even if the field was never directly collected. This applies whether or not the inference is actually accurate.

Is pseudonymized data the same as anonymized data under GDPR? No, and this distinction causes frequent compliance problems. Pseudonymized data — where identifying details are replaced with codes but a re-identification key still exists somewhere — remains personal data under GDPR. Only genuinely anonymized data, with no possible way to link it back to a person, falls outside GDPR's scope.

If we combine several small pieces of non-identifying data, does that count as personal data? Yes. Individual data points like browser type, rough location, or login times may not identify anyone alone, but GDPR treats a combination of such points as personal data if, together, they can point to one specific individual.

Can financial transaction data reveal special category information? Yes. A pattern of donations to a political party or religious organization can reveal political opinions or religious beliefs, even without those categories being explicitly recorded. Regulators have confirmed this kind of inference counts as processing special category data under Article 9.

What happens if a company mistakenly treats pseudonymized data as anonymized? This is a common and risky error. If a re-identification key exists anywhere — even if it's rarely used or securely stored — the data is still legally personal data, and all GDPR obligations still apply to it, regardless of how the company labels it internally.

Why does it matter whether something counts as personal data or not? Misjudging the scope creates problems in both directions: treating non-personal data as personal data adds unnecessary compliance overhead, while failing to recognize actual personal data — especially inferred special category data — leaves a real compliance gap a regulator could later flag.

Does understanding what counts as personal data help with other compliance frameworks? Yes. Accurately scoping personal and special category data is foundational work that also supports ISO 27001 and SOC 2, both of which require organizations to know exactly what sensitive data they hold and where before building appropriate controls.