Personal Data
Definition
Under the GDPR, personal data means any information relating to an identified or identifiable natural person. The word identifiable is doing the heavy lifting: it covers data that names someone outright and data that singles them out when set beside information someone else holds. So a name, an email address, a photograph and a phone number are obvious members, and so are cookie identifiers, device fingerprints, order numbers and login handles. A special category sits on top — health, ethnicity, religion, political opinions, trade union membership, sexual orientation, biometrics — with stricter conditions attached. Pseudonymised data, where names are replaced by reference codes but a key still exists somewhere, remains personal data; only genuinely anonymous data, which nobody can reverse, falls outside the rules entirely, and that bar is higher than it sounds.
Why It Matters
The IP address case is the one that catches website owners out. In Breyer, decided by the Court of Justice in 2016, a dynamic address held by a website operator was found to be personal data, because the operator could plausibly identify the subscriber with the help of the internet provider. That single conclusion is why cookie-free analytics still has thinking to do: the banner may be unnecessary, but the addresses arriving in every request are regulated the moment you write them down. The usual answer is not to write them down — derive a country and a repeat-visit signal, then discard, or hash the address with a salt that rotates each day so yesterday's visitors cannot be matched to today's. Nothing here is legal advice, but the practical rule holds: data you never stored cannot leak, cannot be subpoenaed, and cannot appear in a subject access request.
How It Works
Working out whether something is personal data is a test of what could be linked, not of what the field is called. Start with the records you actually hold — form submissions, access logs, support emails, billing rows, the analytics store — and ask, for each, whether one person could be picked out from it alone or with reasonable help. Where the answer is yes, record the purpose, the lawful basis and how long you keep it. Reduction is the main technique available to a small operation: truncating an address to its network part, hashing with a rotating salt, keeping daily totals rather than the rows they came from, and deleting the raw material once the aggregate exists. Be honest about one thing, though: hashing alone is weak on a small set of possible values, because anyone with the salt can hash all four billion IPv4 addresses and match them back, which is exactly why the salt has to rotate and never be stored beside the hashes.
Real-World Example
A recruiter publishes a hiring pack at roles-2026.99helpers.site with a form for candidates to register interest, collecting name, email and a short note. That form store is plainly personal data and gets a purpose, a notice and a ninety-day life. The visit statistics beside it are not the same thing: 99helpers counts views, referrers and countries at the edge without storing raw addresses, so the traffic report is a set of numbers rather than a record of who looked at the role. Two stores, two very different obligations, and telling them apart took one conversation.
Common Mistakes
- ✕Believing that removing names makes data anonymous — if a key or a linkable identifier still exists, it is pseudonymous and still regulated
- ✕Filing raw addresses in an analytics table for future analysis — the future analysis never happens and the liability accumulates anyway
- ✕Copying special category data without noticing, such as a dietary requirement field on an event form that reveals religion or health
Related Terms
GDPR
The European Union's General Data Protection Regulation, in force since 25 May 2018, governing how personal data about people in the EU may be collected and used. The UK keeps a near-identical version in its own law.
IP Address
The number that identifies a machine on the internet, so packets know where to go. Every request a visitor makes carries the address it came from, which is why addresses turn up in logs, analytics and privacy law.
Cookie Consent
Permission a visitor gives before a site stores or reads non-essential information on their device. A site that sets nothing beyond what it strictly needs does not require a banner at all.
Data Retention
How long data is kept before it is deleted, and the rules that decide that. Keeping everything forever is a decision too, and usually the wrong one.
Web Analytics
Measuring who visits a site and what they look at. The two methods — a script running in the visitor's browser, or counting each request as it is served — produce different numbers, and neither of them is wrong.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →