What Counts as Personal Data Under GDPR, and the Six Things People Get Wrong
GDPR uses one sentence to define personal data. Article 4(1) calls it "any information relating to an identified or identifiable natural person". Everything else follows from that sentence, so it helps to read it slowly. Two words do the work. Identified means you already know who it is. Identifiable means you could work it out. Things that count The European Commission gives a plain list: a name and surname, a home address, an email address, an IP address, an identification card number, a cookie ID, and the advertising identifier of your phone. Video recording from CCTV is on the list too. Things that do not count A company registration number is not personal data. A generic mailbox such as info@company.com is not personal data. Truly anonymised information is outside GDPR, and only when the anonymisation cannot be reversed. The six mix ups Assuming work emails are exempt. A named address like sarah.jones@company.com identifies a person, so it counts. Treating coded record...