A person's name, email address, and contact number are easy to recognize as personal data. But have you ever wondered about an IP address, customer ID, or location history? These details may not show a person's identity at first glance, but they can often be connected to a particular individual.
So, the very basic question is: what counts as personal data?
The answer depends on whether the information can identify someone, either directly or indirectly, and on the data privacy laws that apply. The GDPR, CCPA/CPRA, UK GDPR, LGPD, and PIPL may treat the same set of information differently depending on the context.
This is where businesses often face challenges. Information that appears anonymous on its own can identify a person when it is combined with other data.
Once you understand what counts as personal data, it becomes much easier to identify the relevant privacy obligations. This can also help businesses understand when data subject rights may apply.
What Counts as Personal Data in a Modern Privacy Context
To understand whether the information qualifies as personal data, look beyond direct identifiers like names and email addresses. Modern privacy laws focus on a core principle: linkability. Information can also be personal data when it can be connected to a particular person, even if that connection requires combining it with other information.
For example, a customer ID may look meaningless by itself:
Customer_220398
On its own, this identifier reveals very little. But what if a business has a separate system that connects this ID to a customer's name, email, and purchase history? This ID can be one piece of information used to identify or relate to that person.
As a result, businesses need to consider personal data in context rather than assuming it is anonymous because it lacks an individual's name.
Where Personal Data Shows Up in Daily Life
Personal data can appear across a wide range of business systems and digital environments. Businesses can collect information from many everyday situations, including online shopping, app use, website visits, and workplace activities.
Buying something online is a good example of how personal data can build up. The business needs information to process and deliver the order. At the same time, the website can collect information about your device, your IP address, cookies, and the pages you visit.
Over time, these records can build a detailed picture of the customer.
The same pattern appears across other business environments. Personal data may be found in:
- Websites and mobile apps
- Customer relationship systems
- Employee and HR systems
- Marketing platforms
- Customer support tools
- Location-based services
This means personal data should not be viewed as information stored in one particular database. It can exist across multiple systems, vendors, and business processes throughout the lifecycle of a customer or employee relationship.
What Information Counts as Personal Data?
Direct Identifiers
Some forms of personal data identify an individual immediately. These are often called direct identifiers.
Examples include a person's name, email address, phone number, residential address, passport number, or driver's license number.
Indirect Identifiers
Some information may not identify a person on its own, but it can when combined with other records. Even without a person's name, the data may still be personal if it can be connected to their account, device, or other identifying details.
Examples include IP addresses, device IDs, customer reference numbers, usernames, cookie identifiers, and location history.
Personal Data Is Context-Dependent
There is no universal list that can tell a business whether every piece of information is personal data. It depends on what the business already has and whether it can associate that information with a particular person. At first, the data may look anonymous, but become identifiable when linked with account records, location patterns, or other available data.
A useful operational question is: Could this information reasonably be linked to a particular person using information available to us or likely to be available?
The answer can vary as systems, datasets, and available information change.
How Global Privacy Laws Define Personal Data
Major privacy laws generally protect information that identifies a person or can be linked to them. However, the laws differ in their scope and terminology. They also have different rules for protecting sensitive information.
GDPR
Under the GDPR, personal data includes information that can identify a person directly or indirectly. Pseudonymized data can still be personal data if it can be linked back to a person using additional information. Truly anonymous information is different and not covered by the GDPR.
UK GDPR
The UK GDPR uses a definition of personal data similar to the EU GDPR. It covers information that can identify a person, either directly or indirectly. Properly anonymized information that can no longer identify a person falls outside the definition of personal data.
CCPA, as Amended by the CPRA
Under California law, information does not have to contain a person's name to be protected.  If it can be connected to a person or household, the CCPA may treat it as personal information. Some sensitive information has additional protection, including precise geolocation and health-related information.
Brazil's LGPD
Brazil's LGPD defines personal data as information related to an identified or identifiable natural person.  It also provides specific rules for sensitive personal data and cross-border data transfers.
China's PIPL
China's PIPL defines personal information as information that can identify a person, directly or indirectly. It also provides extra protection for sensitive personal information, such as biometric, medical, and precise location data.
Pseudonymized Does Not Automatically Mean Anonymous
Pseudonymization replaces direct identifiers with another value, such as a code or customer number. This reduces direct identification, but the information may still be linked to the person through additional records.
For example, a research dataset might replace a patient's name with a participant code. The patient may still be identifiable if the organization keeps a separate record linking the code to them.
The key difference is that, with properly anonymized data, the person cannot be identified even with additional information. Removing a person's name does not automatically make the data anonymous.
Is Biometric Data Personal Data?
Biometric data can count as personal information when it can identify a person.
Consider a workplace that uses facial scans or fingerprints to recognize employees. The system links the biometric data to an employee's identity.
Some privacy laws provide additional protection when biometric data is used to identify an individual uniquely. Therefore, businesses need to consider two things: what biometric data they collect and how they use that data.
Storing biometric data as numbers or mathematical patterns does not automatically make it anonymous. If the information can still be linked to a person, it may remain subject to privacy requirements.
Do You Need a Data Protection Officer?
The answer depends on the applicable law and the nature of the processing activity.
Under the GDPR, certain organizations must appoint a Data Protection Officer (DPO). An organization may need a DPO if it monitors people on a large scale or handles large amounts of sensitive personal data.
Not every business requires a DPO. However, organizations should still assign clear responsibility for managing personal data and meeting applicable privacy requirements.
How Can You Check Whether Information Is Personal Data?
Businesses should consider the following questions early.
- Can this information be linked to an individual using other records we hold?
- Could a vendor, partner, or third party connect it to a person?
- Does it track a device, account, or individual over time?
- Does it contain biometric, health, or location information?
- Would the information still appear anonymous if you reviewed all related datasets together?
If even one answer is yes, check whether the information needs protection under privacy laws.
Final Thoughts
Understanding what counts as personal data is not simply about checking whether a person's name or email address appears in a dataset. Information such as IP addresses, device IDs, location records, biometric data, and internal identifiers can also fall within privacy laws when they can be linked to an individual. The key is to look at the information in context and understand the data protection requirements that may apply.
For more such information, visit our official website.
FAQs
Q1. Is personal data the same as personally identifiable information (PII)?
Answer: PII is information that can identify a person, such as their name or ID number. Personal data can cover a wider range of information about a person, depending on the privacy law.
Q2. Can the same information be personal data under one law but not another?
Answer: Yes. Privacy laws use different definitions and scopes. As a result, the same information may be treated differently depending on the applicable law and how the information is used.
Q3. Who Decides What Counts as Personal Data?
Answer: There is no single global authority that decides what information counts as personal data. The applicable privacy law sets the relevant definition. Regulators and courts can clarify how those rules apply in specific cases.
Also Read:
