What Counts as Personal Data Under GDPR?

Personal data under GDPR is defined broadly, covering any information that can directly or indirectly identify an individual.

Examples include:

• Names, email addresses, phone numbers

• Identification numbers (e.g., national ID, tax ID)

• Location data and IP addresses

• Online identifiers (cookies, device IDs)

• Biometric data

• Health information

• Financial data

• Any combination of data points that can identify an individual

Understanding what qualifies as personal data is essential for scoping GDPR compliance efforts and ensuring that appropriate controls are in place.

This clarity also supports alignment with global standards such as ISO 27001 and SOC 2.