Personal Data

Definition under Art. 4(1) GDPR — any information relating to an identified or identifiable person

26 April 2026 · Category: GDPR · Compliance-Kit

TL;DR

Under Art. 4(1) GDPR, personal data means any information relating to an identified or identifiable natural person. A person is identifiable where they can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or specific characteristics.

What is Personal Data?

Three core criteria:

Information: any reference that can be attributed to a person (objective or subjective)
Person: natural persons only — not legal persons, not deceased persons
Identifiable: with proportionate effort

CJEU C-582/14 (Breyer): IP addresses are personal data where the controller is legally or practically able to link them to a person.

Practical example

Practical examples:

Name, address, email address, telephone number
IP address, cookie IDs, session IDs
Employee personnel number, customer number
Photo, video, voice recording
Location data (GPS), vehicle registration numbers
Behavioural data (click behaviour, purchase history)
Genetic, biometric and health data (special categories, Art. 9)

Frequently asked questions

Is anonymised data personal data?

No. Genuine anonymisation (irreversible, no re-identification risk) renders data non-personal — the GDPR then does not apply. Pseudonymisation is NOT sufficient — the data remains personal data.

Are IP addresses personal data?

Yes, CJEU C-582/14. This also covers dynamic IP addresses, provided identification is possible with proportionate effort (for example by a request to the provider).

What are special categories (Art. 9)?

Data revealing racial origin, ethnic origin, political opinions, religion, trade union membership, genetics, biometrics, health or sex life. Higher protection requirements apply.