What type of data is protected by the GDPR?

Personal information is protected under the GDPR and refers to data that can be used to identify an individual, either on its own or in combination with other data

It is explicitly defined in Article 4 of the GDPR as:

‘… any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular reference to an identifier such as a name, an identification number, location data, and online identifier or to one or more factors to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.’

Examples of personal information include (but are not limited to):

• Names
• Email addresses
• Home addresses
• Phone numbers
• Cookie identifiers
• Location data
• Online usernames or handles
• Identification numbers (i.e., passports, ID cards)
• Geolocations
• IP addresses
• Payment information
• Data collected via cookies
• Race or ethnic origin
• Sexual orientation
• Health data
• Genetic data
• Biometric data