What counts as personal data under UK GDPR? The answer is broader than most people assume, and it trips up a lot of otherwise careful businesses. Personal data means any information relating to an identified or identifiable living person. That covers the obvious stuff, like names and addresses, but it also stretches into territory that catches organisations off guard, such as IP addresses, CCTV footage, and even opinions written about someone in an internal email. If a piece of information can be linked back to a specific person, directly or indirectly, it is personal data, and it falls under the rules.
The Basic Legal Definition
UK GDPR defines personal data as any information relating to an identified or identifiable natural person, often referred to as the “data subject.” An identifiable person is someone who can be recognised, directly or indirectly, through an identifier such as a name, an ID number, location data, or an online identifier. The key word is “indirectly.” You do not need someone’s full name sitting in a spreadsheet for that spreadsheet to contain personal data. A combination of details, a job title, a department, and a start date, might be enough to work out exactly who someone is, even without naming them outright.
A lot of businesses underestimate their own exposure here. They think of personal data as a narrow category, something that lives in an HR system or a customer database, when really it can turn up in call logs, meeting notes, survey responses, or a folder of old project files nobody has looked at in years.
Everyday Examples People Miss
Some categories of personal data are easy to spot. Full names, home addresses, email addresses, phone numbers, and national insurance numbers all fall squarely into the definition. Plenty of other examples are less obvious, though, and these are the ones that cause problems during audits or after a data breach.
IP addresses, device identifiers, and browser cookies can all count as personal data if they can be tied back to an individual, which is often possible in practice. The ICO’s guide to what is personal information lists online identifiers, including IP addresses and cookie identifiers, as information that may be personal data, and notes that the guidance is under review because of changes made by the Data (Use and Access) Act, so check it for updates. Photographs and video footage, including CCTV, can qualify too, since they can identify a person visually. Even subjective commentary, like a manager’s written assessment of an employee’s performance, counts as personal data about that employee, regardless of whether it is flattering or accurate. Location data from a company phone, recorded voice calls, and biometric data such as fingerprints used for building access also count.
The common thread is identifiability. Something does not need to feel private or secret to count, only to be connected to a real, identifiable person.
Special Category Data Needs Extra Care
Within personal data, there is a smaller, more tightly controlled group known as special category data. This includes information about health, racial or ethnic origin, religious beliefs, sexual orientation, trade union membership, and genetic or biometric data used for identification purposes. Criminal offence data is treated with similarly heightened care, though it sits under its own separate condition rather than within special category data itself.
Organisations handling this kind of information, which includes most healthcare providers, legal practices, and HR functions in any sector, need a specific legal basis before processing it, not just the general justification that might apply to a customer’s name and email. Getting this distinction wrong is a common compliance gap, particularly in sectors where sensitive information is part of day-to-day business and not an edge case.
Why This Matters for Your Business
Understanding what counts as personal data shapes how you design systems, write contracts, train staff, and respond when something goes wrong. If your business does not recognise that a field in your CRM, a transcript from a support call, or a log file on a server counts as personal data, you cannot properly protect it, and you cannot honestly tell a regulator or a client that you have.
This is particularly pressing for businesses building or buying AI tools, where training data, prompts, and outputs can all contain personal data in ways that are not always obvious from the interface. If you are working through what that means for a specific AI deployment, it is worth getting a proper assessment from an AI privacy consultant and not guessing where the boundaries sit.
Getting the scope right also feeds directly into broader security and compliance work. Many of the controls that protect personal data, such as access restrictions, encryption, and incident response planning, overlap heavily with the structured approach of ISO 27001, which gives organisations a framework for managing information security risks systematically and not reactively. We cover that across our ISO 27001 articles.
Checking Your Own Exposure
A practical first step is to audit where personal data actually lives in your organisation, instead of assuming you already know. This usually involves looking beyond the obvious systems, such as your customer database or payroll software, and checking shared drives, email archives, third-party tools, and backup systems too. Personal data has a habit of spreading further than people expect, particularly once it has been copied into a spreadsheet for a one-off task and then forgotten about.
If your business is also working towards a security certification, the Cyber Essentials checker gives a quick way to see where the gaps might be, which is a useful starting point before tackling data protection more broadly.
If you are unsure how personal data flows through your AI tools or systems, a proper AI privacy consultation is the clearest way to find out.
