What is personal data? Examples from an ordinary website

Personal data is any information relating to an identified or identifiable living person. That’s the definition in GDPR Article 4(1), and the UK GDPR uses the same words. You don’t need to know someone’s name. If the information could be tied to one person, directly or by putting pieces together, it counts.

For a website, that catches more than people expect. The IP address in your server log, the cookie ID your analytics tool sets, the email in a support thread, the answers in a contact form. All of it is personal data, or can be. This guide walks through what counts, with examples from an ordinary site, what the special categories are, and what the answer means for your privacy notice.

What is personal data under the GDPR

Article 4(1) says an identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or by factors specific to their physical, economic, cultural or social identity. “Online identifier” is in the text itself.

Recital 30 spells out what that means. People may be associated with identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as RFID tags. Those traces, combined with other information, can be used to build profiles of people and identify them.

Two things that aren’t personal data: information about a company, unless it points at a sole trader or a named employee, and information about someone who has died. The ICO says plainly that information relating to a deceased person does not constitute personal data. Anonymised data is also outside, but only if the person really can’t be identified any more. Pseudonymised data, where you’ve swapped the name for a code and kept the key, remains personal data.

Personal data examples from a normal website

Here’s what a typical small company’s website collects, and why each one counts:

• IP addresses. Every visit sends one to your server. The EU court held in Breyer, in October 2016, that a dynamic IP address is personal data for a website operator if it has the legal means to identify the visitor with help from the internet service provider. The ICO lists IP addresses among the online identifiers the UK GDPR recognises.
• Cookie identifiers. The random string in a cookie that lets an analytics or advertising tool recognise the same browser next time. The ICO says that using cookies to track an individual across websites involves the processing of personal data.
• Analytics identifiers. The client ID, user ID and session ID your analytics tool keeps. Same logic as the cookie that carries them.
• Form fields. Name, email, phone, company, message. A contact form is the most obvious collection point on the site.
• Support emails. The address, the name, the content of the message, and anything the person tells you about themselves. A thread about a late order can turn into one about a hospital stay.
• Account and order records. Addresses, purchase history, payment references. California’s law lists records of products purchased and internet browsing history as personal information.
• Newsletter data. The address, and often the open and click data your email tool records against it.
• Comments and reviews. A display name, an avatar, the text, and an IP address in the database.
• Chat widgets. Transcripts, often with the visitor’s page history attached.

Is an email address personal data?

Yes, in almost every case. A personal address names the person. A work address like jane.smith@company names them too. A generic info@ address relates to a business and may not, on its own. The ICO makes a similar point about names: by itself, the name “John Smith” may not always be personal data, because many people share it, but a name with an address or a phone number is usually enough to identify one person.

Are bank details personal data?

Yes. An account number and sort code identify the holder, and California’s list of personal information includes Social Security numbers, the US version of the same idea. They’re not special category data, though. That term has a fixed list, and money isn’t on it.

The special categories

Article 9 picks out data that gets extra protection. Processing it is prohibited unless one of a list of conditions applies, and on a website the usual one is explicit consent. The categories are data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, plus genetic data, biometric data used to identify a person, health data, and data about a person’s sex life or sexual orientation.

For a website this bites in places you might not expect:

• A booking form for a physiotherapy clinic asks what hurts. That’s health data.
• A sign-up form for a church group or a union branch. Membership is the category.
• A dietary requirements field on an event form. “Halal” or “kosher” reveals religion.
• An accessibility needs field. Often health data.
• A photo upload where faces are matched. Biometric data, if you use it to identify people.

I know the dietary example sounds fussy. The ICO’s next point is why it isn’t: an inference counts too. If you profile people to guess their health status or beliefs, you are processing special category data regardless of how confident you are that the inference is correct. Criminal offence data is handled separately. The ICO says it is not special category data, though it has similar safeguards.

What this means for your privacy notice

Once you know what’s personal data on your site, the notice has a job: list it honestly. GDPR Article 13 expects the information at the time the data is collected, and sets out what has to be there, including the purposes, the legal basis, the recipients and the retention period. The Handbook article on Article 13 goes through the twelve items.

Go back down the list of examples. Each one needs a line:

• Server logs and IP addresses: what you keep, for how long, and on what basis. The Breyer judgment also said a website operator may have a legitimate interest in storing certain personal data relating to visitors to keep the site running. Say so.
• Analytics and advertising identifiers: which tools, and which companies receive the data. This is where most notices fall short. Peeky compares the companies your pages contact with the ones your notice names, and the gap is a finding under EU-04.
• Form data: what each form collects and why. In California, a notice at collection is expected at or before the point of collection, so a link next to the form rather than only in the footer.
• Support and chat: that messages are kept, where, and for how long.
• Special categories: name them, and say which Article 9 condition you rely on. If you don’t want to hold health data, say that too, and shape the form so it doesn’t invite it.

California defines personal information as information that identifies, relates to, or could reasonably be linked with you or your household, and it includes inferences that build a profile of someone’s preferences. If you sell to Californians, your notice covers that framing as well.

A five-minute check for your own site

Use a phone. You need no tool.

1. Open your homepage and count the forms you can reach in two taps: contact, newsletter, quote, booking, login. Each one is a collection point.
2. For each form, read the fields. Mark any that could reveal health, religion, politics, union membership or sexuality, free-text boxes included.
3. Open your privacy notice and search for “IP”. If your server logs or analytics keep IP addresses and the notice doesn’t mention them, that’s a gap.
4. Search the notice for the name of your analytics tool and your email tool. If they’re not named, or only “third parties” is, note it.
5. Search for “cookie” and check that the identifiers set by analytics or ads tools are described, with a purpose and a basis.
6. Look at the point of collection. Is there a link to the notice next to the form, not only at the bottom of the page?
7. Pick one special-category field you found, if any. Does the notice say which Article 9 condition you rely on? If it’s consent, is it a separate, explicit tick, not a pre-ticked box?

Then compare what you found with what the notice says. Whatever sits in the gap is the week’s work.

Peeky reads the public pages of your site. For what counts as personal data and whether your notice covers it, the checks are EU-08 and EU-04 in the Handbook, and US-05 for the notice at collection California expects next to a form. For what people can ask you to do with that data once you hold it, see the right to be forgotten, and for the trackers that set those identifiers, what a tracking pixel is.

Questions people ask

What are 5 examples of personal data?

A name with an address, an email address, an IP address, a cookie identifier, and the content of a support email. GDPR Article 4(1) names an identification number, location data and an online identifier among the identifiers, and Recital 30 gives IP addresses and cookie identifiers as examples of online identifiers.

Is an email address personal data?

In almost every case, yes. A personal address names the person, and a work address like jane.smith@company does too. A generic info@ address relates to a business and may not, on its own. The ICO makes the same point about a bare name: "John Smith" may not always be personal data because many people share it, but add an address and it is.

What is not classed as personal data?

Information about a company rather than a person, information about someone who has died, and data that has been anonymised so that nobody can be identified from it. The ICO says information relating to a deceased person does not constitute personal data. Pseudonymised data, where the name is swapped for a code and the key is kept, still is.

Are bank details classed as personal data?

Yes. An account number identifies its holder. They are not special category data, though. That term has a fixed list in Article 9: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, health, sex life and sexual orientation.

Is an IP address personal data?

For a website operator, yes, where the operator has a legal way to identify the visitor. The EU court's Breyer judgment of 19 October 2016 held that a dynamic IP address is personal data for the operator if it has the legal means to identify the visitor with help from the internet service provider. The ICO lists IP addresses among online identifiers.