Personal data

GDPR Article 4(1) defines personal data through four elements: "any information", "relating to", "an identified or identifiable", "natural person". Each is read broadly. Information can be objective or subjective, true or false. It relates to a person by content, purpose or effect, so a car's telemetry relates to its driver when used to assess driving behaviour. A person is identifiable when they can be singled out directly or indirectly by reference to an identifier such as a name, identification number, location data or online identifier, or to factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity. Legal persons are outside the definition (recital 14), and so are the dead (recital 27), although member states may extend protection; Denmark's Data Protection Act (databeskyttelsesloven) § 2(5) applies the rules to deceased persons for ten years after death.

Identifiability is a risk test, not a technical absolute. Recital 26 asks whether identification is possible using "all the means reasonably likely to be used", considering cost, time and available technology. In Breyer (C-582/14, 2016) the CJEU held that a dynamic IP address can be personal data for a website operator that has legal means to obtain the subscriber's identity from the ISP. In EDPS v SRB (C-413/23 P, 4 September 2025) the Court confirmed that pseudonymised data remains personal data for the controller holding the key but may not be personal data for a recipient that cannot reasonably re-identify anyone, making the assessment dependent on whose perspective is taken. Pseudonymisation under Article 4(5) is therefore a security measure, not an exit from the GDPR; only anonymisation that withstands singling out, linkability and inference, the three tests of the Article 29 Working Party's Opinion 05/2014, takes data out of scope.

Special categories under Article 9(1) are racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed to uniquely identify a person, health data and data on sex life or sexual orientation; processing is prohibited unless an Article 9(2) exception applies. Criminal convictions and offences are handled separately under Article 10. Danish CPR numbers are not a special category but have their own processing rules in databeskyttelsesloven § 11, based on the opening in GDPR Article 87.

In engineering practice the hard cases are indirect identifiers: device IDs, cookie IDs, advertising IDs, precise location traces, hashed e-mail addresses (a deterministic hash of an e-mail address is a stable identifier, not anonymisation), free-text fields, log files and embeddings or model weights that can reproduce training examples. Data classification and records of processing (Article 30) should treat such fields as personal data by default, with retention limits and access control to match.