What is personal data?
Personal data, according to Article 4(1) of the GDPR, refers to any information relating to an identified or identifiable natural person (referred to as the "data subject"). An identifiable natural person is someone who can be directly or indirectly identified, particularly by reference to an identifier such as a name, identification number, location data, online identifier, or one or more specific factors related to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. (Source: GDPR Regulation)
It includes all data that can directly or indirectly identify a specific person. This means directly identifiable data, such as phone numbers, names, emails, national identification numbers, etc., and indirectly identifiable data, which can be derived from information provided by another person. The previous requirement of having a minimum of three pieces of information to identify a specific person no longer applies.
The personal data of the data subject must be handled on the basis of the GDPR if it is not used for private purposes, i.e. the GDPR does not address whether the person processing the personal data is a legal or natural person (e.g. influencers, youtubers and households with CCTV systems also targeting public spaces must comply with the GDPR).
