What is personal data?

<!doctype html>    <html lang="en">  <head prefix="og: http://ogp.me/ns#"><script type="text/javascript" src="/_static/js/bundle-playback.js?v=HxkREWBo" charset="utf-8"></script> <script type="text/javascript" src="/_static/js/wombat.js?v=txqj7nKC" charset="utf-8"></script> <script>window.RufflePlayer=window.RufflePlayer||{};window.RufflePlayer.config={"autoplay":"on","unmuteOverlay":"hidden"};</script> <script type="text/javascript" src="/_static/js/ruffle/ruffle.js"></script> <script type="text/javascript"> __wm.init("http://web.archive.org/web"); __wm.wombat("https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/","20220927005144","http://web.archive.org/","web","/_static/", "1664239904"); </script> <link rel="stylesheet" type="text/css" href="/_static/css/banner-styles.css?v=S1zqJCYt" /> <link rel="stylesheet" type="text/css" href="/_static/css/iconochive.css?v=3PDvdIFv" />  <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="initial-scale=1.0, width=device-width"> <title>What is personal data? | ICO</title>   <meta name="DC.Subject" content=""/> <meta name="DC.Date" content="Friday, January 1, 2021"/> <meta name="DC.Creator" content=""/> <meta name="DC.Publisher" content="ICO"/> <meta name="DC.Title" content="What is personal data?"/> <meta name="DC.PageID" content="32924"/>   <meta property="og:title" content="What is personal data?"/> <meta property="og:type" content="website"/> <meta property="og:url" content="http://web.archive.org/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/"/> <meta property="og:description" content=""/> <meta property="og:image" content="/web/20220927005144im_/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/"/> <meta name="twitter:title" content="What is personal data?"/> <meta name="twitter:description" content=""/>  <link rel="shortcut icon" type="image/x-icon" href="/web/20220927005144im_/https://ico.org.uk/favicon.ico"/> <link href="/web/20220927005144cs_/https://ico.org.uk/cassette.axd/stylesheet/76050da21e2bc1f12d1e5731d22312f56144430f/css" type="text/css" rel="stylesheet"/>  <script src="/web/20220927005144js_/https://ico.org.uk/cassette.axd/script/5ee23aacdf970dd872941ccf4f703a43bccb2949/scripts/responsive-nav.min.js" type="text/javascript"></script> <script src="/web/20220927005144js_/https://ico.org.uk/cassette.axd/script/e959342b74f6ed9b82c2aa42af0bcf7fd59f2d10/scripts/lib" type="text/javascript"></script>    </head> <body id="top" class=""> <a class="link-skiptocontent invisible" href="#startcontent">Skip to main content <span class="icon-arrow-down"></span></a> <header class="header-banner"> <div class="container-header"> <div class="container row"> <div class="column column-3 siteheader-logo"> <a href="/web/20220927005144/https://ico.org.uk/"><span class="invisible">ICO: Information Commissioner's Office</span></a> </div> <div class="column column-6 siteheader-strapline h4"> <div class="siteheader-strapline-inner"> <p>The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.</p> </div> </div> <a href="" class="button-icon" id="toggle-siteheader-search"><span class="icon-search"></span><span class="invisible">Search</span><span class="icon-close"></span></a> <form action="http://web.archive.org/web/20220927005144/https://icosearch.ico.org.uk/s/search.html" method="GET" class="column column-3" id="siteheader-search"> <fieldset> <legend class="invisible">Search</legend> <div class="siteheader-search-form"> <label for="search" class="invisible">Search</label> <input type="search" id="search" name="query"> <input type="hidden" name="collection" value="ico-meta"/> <input type="hidden" name="profile" value="_default"/> <span class="button-icon icon-search"></span> <input type="submit" value="Search"> </div> </fieldset> </form> </div> </div> <div class="container-navigation"> <div class="container row"> <nav class="column column-12" aria-label="Main menu"> <ul> <li class="h3 theme-home"> <a href="/web/20220927005144/https://ico.org.uk/">Home<span class="icon-arrow-right"></span></a> </li> <li class="h3 theme-public"> <a href="/web/20220927005144/https://ico.org.uk/your-data-matters/">Your data matters<span class="icon-arrow-right"></span></a> </li> <li class="h3 theme-organisations"> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/" class="current">For organisations<span class="icon-arrow-right"></span></a> </li> <li class="h3 theme-report"> <a href="/web/20220927005144/https://ico.org.uk/make-a-complaint/">Make a complaint<span class="icon-arrow-right"></span></a> </li> <li class="h3 theme-action"> <a href="/web/20220927005144/https://ico.org.uk/action-weve-taken/">Action we've taken<span class="icon-arrow-right"></span></a> </li> <li class="h3 theme-about"> <a href="/web/20220927005144/https://ico.org.uk/about-the-ico/">About the ICO<span class="icon-arrow-right"></span></a> </li> </ul> </nav> </div> </div> </header> <main class="theme-organisations" id="startcontent"> <article class="container"> <header class="pageheader"> <div class="downloadandShare"> <div class="row"> <div class="column column-8"> <nav aria-label="breadcrumb" class="pageheader-breadcrumb text-small clearfix"> <ol> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/">For organisations</a><span>/</span> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/">Guide to Data Protection</a><span>/</span> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/">Guide to the General Data Protection Regulation (GDPR)</a><span>/</span> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/">Key definitions</a><span>/</span> </li> <li> <span class="current" aria-current="page" aria-label="Current page"> What is personal data? </span> </li> </ol> </nav> <h1 id="multipage-heading">What is personal data?</h1> <div id="multipage-snippet"> </div> </div> <div class="pageheader-download column column-4 column-indent-1"> <a href="#" id="toggle-hiddenpanel-headershare"><span class="h4">Share<span class="invisible">(Opens Share panel)</span></span><span class="button-circle"><span class="icon-share"></span></span></a> <a href="#" id="toggle-hiddenpanel-download"><span class="h4">Download options<span class="invisible">(Opens download panel)</span></span><span class="button-circle"><span class="icon-download"></span></span></a> </div> </div> <div class="hiddenpanel clearfix toggle-right" id="hiddenpanel-headershare" aria-label="panel share" style="display: none;"> <h2 class="h4">Share this page</h2> <ul class="clearfix"> <li> <a href="http://web.archive.org/web/20220927005144/https://www.reddit.com/submit?url=https:%2f%2fico.org.uk%2ffor-organisations%2fguide-to-data-protection%2fguide-to-the-general-data-protection-regulation-gdpr%2fkey-definitions%2fwhat-is-personal-data%2f" target="_blank" class="button-circle"> <span class="icon-reddit"></span> <span class="invisible">Share via Reddit</span> </a> </li> <li> <a href="http://web.archive.org/web/20220927005144/https://www.linkedin.com/shareArticle?mini=true&title=What+is+personal+data%3f&url=https:%2f%2fico.org.uk%2ffor-organisations%2fguide-to-data-protection%2fguide-to-the-general-data-protection-regulation-gdpr%2fkey-definitions%2fwhat-is-personal-data%2f&source=Ico.org.uk" target="_blank" class="button-circle"> <span class="icon-linkedin"></span> <span class="invisible">Share via LinkedIn</span> </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/cdn-cgi/l/email-protection#7b4419141f0246130f0f0b08415e491d5e491d1218145514091c550e105e491d1d14095614091c1a1512081a0f121415085e491d1c0e121f1e560f14561f1a0f1a560b09140f1e180f1214155e491d1c0e121f1e560f14560f131e561c1e151e091a17561f1a0f1a560b09140f1e180f12141556091e1c0e171a0f121415561c1f0b095e491d101e02561f1e1d1215120f121415085e491d0c131a0f561208560b1e090814151a17561f1a0f1a5e491d" target="_blank" class="button-circle"> <span class="icon-envelope"></span> <span class="invisible">Share via email</span> </a> </li> </ul> </div> <div class="hiddenpanel hiddenpanel-options clearfix" id="hiddenpanel-download"> <form method="post" action="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/" target="_blank"> <fieldset> <legend class="invisible">Download options</legend> <div class="hiddenpanel-options-row"> <h2 class="h4">Pages</h2> <ul class="form-checkbox-list form-checkbox-list-buttons clearfix"> <li><input type="radio" name="pages" id="pages-all" value="all" checked><label for="pages-all"><span class="icon-files"></span> All pages</label></li> <li><input type="radio" name="pages" id="pages-this" value="this"><label for="pages-this"><span class="icon-file"></span> This page</label></li> </ul> </div> <div class="hiddenpanel-options-row"> <h2 class="h4">Format</h2> <ul class="form-checkbox-list form-checkbox-list-buttons clearfix"> <li><input type="radio" name="format" id="format-pdf" value="pdf" checked><label for="format-pdf"><span class="icon-file-pdf"></span> PDF</label></li> </ul> </div> <button class="button">Download <span class="icon-download"></span></button> </fieldset> </form> </div> </div> </header> <div class="row"> <aside class="toc toc-multipage column column-3" aria-label="Search for documents filter"> <nav aria-label="Filtered Documents"> <form method="GET" class="toc-search"> <p> <label for="toc-search" class="invisible">Search article</label> <input type="search" id="toc-search" name="q" placeholder="Search this document"> <span class="button-icon icon-search" id="toc-search-button-icon"></span> <span class="button-icon icon-search icon-spinner animate-spin" id="toc-search-progress-icon" style="display: none;"> </span> <input type="submit" id="toc-search-button" value="Search"/> <span class="invisible" role="status" id="toc-search-status"></span> </p> </form> <ul> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/" class=""> About the Guide to the GDPR </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/whats-new/" class=""> What's new </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/" class=""> Key definitions </a> <ul> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/" class="current"> What is personal data? </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/controllers-and-processors/" class=""> Controllers and processors </a> </li> </ul> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/" class=""> Principles </a> <ul> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/lawfulness-fairness-and-transparency/" class=""> Lawfulness, fairness and transparency </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/purpose-limitation/" class=""> Purpose limitation </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/data-minimisation/" class=""> Data minimisation </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/accuracy/" class=""> Accuracy </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/storage-limitation/" class=""> Storage limitation </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/integrity-and-confidentiality-security/" class=""> Integrity and confidentiality (security) </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/accountability-principle/" class=""> Accountability principle </a> </li> </ul> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/" class=""> Lawful basis for processing </a> <ul> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/" class=""> Consent </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/contract/" class=""> Contract </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legal-obligation/" class=""> Legal obligation </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/vital-interests/" class=""> Vital interests </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/public-task/" class=""> Public task </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/" class=""> Legitimate interests </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/special-category-data/" class=""> Special category data </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/criminal-offence-data/" class=""> Criminal offence data </a> </li> </ul> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/" class=""> Individual rights </a> <ul> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-be-informed/" class=""> Right to be informed </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/" class=""> Right of access </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-rectification/" class=""> Right to rectification </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/" class=""> Right to erasure </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-restrict-processing/" class=""> Right to restrict processing </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-data-portability/" class=""> Right to data portability </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-object/" class=""> Right to object </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/rights-related-to-automated-decision-making-including-profiling/" class=""> Rights related to automated decision making including profiling </a> </li> </ul> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/" class=""> Accountability and governance </a> <ul> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/contracts/" class=""> Contracts </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/documentation/" class=""> Documentation </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-by-design-and-default/" class=""> Data protection by design and default </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-impact-assessments/" class=""> Data protection impact assessments </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/" class=""> Data protection officers </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/codes-of-conduct/" class=""> Codes of conduct </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/certification/" class=""> Certification </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-fee/" class=""> Data protection fee </a> </li> </ul> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/security/" class=""> Security </a> <ul> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/security/encryption/" class=""> Encryption </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/security/ransomware-and-data-protection-compliance/" class=""> Ransomware and data protection compliance </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/security/passwords-in-online-services/" class=""> Passwords in online services </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/security/security-outcomes/" class=""> Security outcomes </a> </li> </ul> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/" class=""> Personal data breaches </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers-after-uk-exit/" class=""> International transfers after the UK exit from the EU Implementation Period </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data-transfer-agreement-and-guidance/" class=""> International data transfer agreement and guidance </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/exemptions/" class=""> Exemptions </a> <ul> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/exemptions/immigration-exemption/" class=""> Immigration exemption </a> </li> </ul> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/national-security-and-defence/" class=""> National security and defence </a> </li> </ul> </nav> </aside> <div class="maincolumn column column-8 column-indent-1"> <div class="article-content"> <h2>At a glance</h2> <ul> <li>Understanding whether you are processing personal data is critical to understanding whether the UK GDPR applies to your activities.</li> <li>Personal data is information that relates to an identified or identifiable individual.</li> <li>What identifies an individual could be as simple as a name or a number or could include other identifiers such as an IP address or a cookie identifier, or other factors.</li> <li>If it is possible to identify an individual directly from the information you are processing, then that information may be personal data.</li> <li>If you cannot directly identify an individual from that information, then you need to consider whether the individual is still identifiable. You should take into account the information you are processing together with all the means reasonably likely to be used by either you or any other person to identify that individual.</li> <li>Even if an individual is identified or identifiable, directly or indirectly, from the data you are processing, it is not personal data unless it ‘relates to’ the individual.</li> <li>When considering whether information ‘relates to’ an individual, you need to take into account a range of factors, including the content of the information, the purpose or purposes for which you are processing it and the likely impact or effect of that processing on the individual.</li> <li>It is possible that the same information is personal data for one controller’s purposes but is not personal data for the purposes of another controller.</li> <li>Information which has had identifiers removed or replaced in order to pseudonymise the data is still personal data for the purposes of UK GDPR.</li> <li>Information which is truly anonymous is not covered by the UK GDPR.</li> <li>If information that seems to relate to a particular individual is inaccurate (ie it is factually incorrect or is about a different individual), the information is still personal data, as it relates to that individual.</li> </ul> <h2>In brief</h2> <ul> <li><a href="#1" title="personal data explained">What is personal data?</a></li> <li><a href="#2">What are identifiers and related factors?</a></li> <li><a href="#3">Can we identify an individual directly from the information we have?</a></li> <li><a href="#4">Can we identify an individual indirectly from the information we have (together with other available information)?</a></li> <li><a href="#5">What is the meaning of ‘relates to’?</a></li> <li><a href="#6">What happens when different organisations process the same data for different purposes?</a></li> <li><a data-id="32967" href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/what-is-personal-data/" title="What is personal data?">In more detail</a></li> </ul> <h3><a id="1"></a>What is personal data?</h3> <ul> <li>The UK GDPR applies to the processing of personal data that is: <ul> <li>wholly or partly by automated means; or</li> <li>the processing other than by automated means of personal data which forms part of, or is intended to form part of, a filing system.</li> </ul> </li> <li>Personal data only includes information relating to natural persons who: <ul> <li>can be identified or who are identifiable, directly from the information in question; or</li> <li>who can be indirectly identified from that information in combination with other information.</li> </ul> </li> <li>Personal data may also include special categories of personal data or criminal conviction and offences data. These are considered to be more sensitive and you may only process them in more limited circumstances.</li> <li>Pseudonymised data can help reduce privacy risks by making it more difficult to identify individuals, but it is still personal data.</li> <li>If personal data can be truly anonymised then the anonymised data is not subject to the UK GDPR. It is important to understand what personal data is in order to understand if the data has been anonymised.</li> <li>Information about a deceased person does not constitute personal data and therefore is not subject to the UK GDPR.</li> <li>Information about companies or public authorities is not personal data.</li> <li>However, information about individuals acting as sole traders, employees, partners and company directors where they are individually identifiable and the information relates to them as an individual may constitute personal data.</li> </ul> <h3><a id="2"></a>What are identifiers and related factors?</h3> <ul> <li>An individual is ‘identified’ or ‘identifiable’ if you can distinguish them from other individuals.</li> <li>A name is perhaps the most common means of identifying someone. However whether any potential identifier actually identifies an individual depends on the context.</li> <li>A combination of identifiers may be needed to identify an individual.</li> <li>The UK GDPR provides a non-exhaustive list of identifiers, including: <ul> <li>name;</li> <li>identification number;</li> <li>location data; and</li> <li>an online identifier.</li> </ul> </li> <li>‘Online identifiers’ includes IP addresses and cookie identifiers which may be personal data.</li> <li>Other factors can identify an individual.</li> </ul> <h3><a id="3"></a>Can we identify an individual directly from the information we have?</h3> <ul> <li>If, by looking solely at the information you are processing you can distinguish an individual from other individuals, that individual will be identified (or identifiable).</li> <li>You don’t have to know someone’s name for them to be directly identifiable, a combination of other identifiers may be sufficient to identify the individual.</li> <li>If an individual is directly identifiable from the information, this may constitute personal data.</li> </ul> <h3><a id="4"></a>Can we identify an individual indirectly from the information we have (together with other available information)?</h3> <ul> <li>It is important to be aware that information you hold may indirectly identify an individual and therefore could constitute personal data.</li> <li>Even if you may need additional information to be able to identify someone, they may still be identifiable.</li> <li>That additional information may be information you already hold, or it may be information that you need to obtain from another source.</li> <li>In some circumstances there may be a slight hypothetical possibility that someone might be able to reconstruct the data in such a way that identifies the individual. However, this is not necessarily sufficient to make the individual identifiable in terms of UK GDPR. You must consider all the factors at stake.</li> <li>When considering whether individuals can be identified, you may have to assess the means that could be used by an interested and sufficiently determined person.</li> <li>You have a continuing obligation to consider whether the likelihood of identification has changed over time (for example as a result of technological developments).</li> </ul> <h3><a id="5"></a>What is the meaning of ‘relates to’?</h3> <ul> <li>Information must ‘relate to’ the identifiable individual to be personal data.</li> <li>This means that it does more than simply identifying them – it must concern the individual in some way.</li> <li>To decide whether or not data relates to an individual, you may need to consider: <ul> <li>the content of the data – is it directly about the individual or their activities?;</li> <li>the purpose you will process the data for; and</li> <li>the results of or effects on the individual from processing the data.</li> </ul> </li> <li>Data can reference an identifiable individual and not be personal data about that individual, as the information does not relate to them.</li> <li>There will be circumstances where it may be difficult to determine whether data is personal data. If this is the case, as a matter of good practice, you should treat the information with care, ensure that you have a clear reason for processing the data and, in particular, ensure you hold and dispose of it securely.</li> <li>Inaccurate information may still be personal data if it relates to an identifiable individual.</li> </ul> <h3><a id="6"></a>What happens when different organisations process the same data for different purposes?</h3> <ul> <li>It is possible that although data does not relate to an identifiable individual for one controller, in the hands of another controller it does.</li> <li>This is particularly the case where, for the purposes of one controller, the identity of the individuals is irrelevant and the data therefore does not relate to them.</li> <li>However, when used for a different purpose, or in conjunction with additional information available to another controller, the data does relate to the identifiable individual.</li> <li>It is therefore necessary to consider carefully the purpose for which the controller is using the data in order to decide whether it relates to an individual.</li> <li>You should take care when you make an analysis of this nature.</li> </ul> </div> <aside class="aside-further" aria-label="Document menu"> <h2 class="offscreen">Further Reading</h2> <ul> <li> <a href="http://web.archive.org/web/20220927005144/https://www.legislation.gov.uk/eur/2016/679/contents" target="_blank"> <h3 class="h4 link-external">Relevant provisions in the UK GDPR - See Articles 2, 4, 9, 10 and Recitals 1, 2, 26, 51<span class="invisible"></span></h3> <div class="text-small"> <p>External link</p> </div> <span class="icon-external-link"></span> </a> </li> </ul> </aside> <div class="article-content"> <div class="greenBlock"> <p><strong>In more detail – ICO guidance</strong></p> <p>We have published detailed guidance on <a data-id="32967" href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/what-is-personal-data/" title="What is personal data?">determining what is personal data</a>.</p> </div> </div> <nav class="article-navigation" aria-label="article"> <a href="#top" class="button-circle" title="Back to top" id="button-top"><span class="icon-arrow-up"></span><span class="invisible">Back to top</span></a> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/" class="button button-icon-left button-previous"><span class="icon-arrow-left"></span> Previous</a> <a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/controllers-and-processors/" class="button button-next button-right">Next <span class="icon-arrow-right"></span></a> </nav> </div> </div> </article> </main> <footer> <div class="footer-sociallinks container row"> <div class="footer-sociallinks-links footer-sociallinks-links--left column column-2"> <ul class=""> <li> <a href="#" class="button-circle" id="toggle-hiddenpanel-share"> <span class="icon-share"></span> <span class="invisible">Share this page</span> </a> </li> <li> <a href="javascript:window.print()" class="button-circle" data-item="Print"> <span class="icon-print"></span> <span class="invisible">Print this page</span> </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/global/rss-feeds/" class="button-circle" data-item="RSS"> <span class="icon-feed"></span> <span class="invisible">RSS feeds</span> </a> </li> </ul> </div> <div class="footer-sociallinks-language column column-2 language-dropdown-container"> <div class="language-dropdown-tab-controls dropdown"> <a href="#" class="visible-xs mobile-tabcontrol" title="Language Selector" aria-haspopup="true" aria-expanded="false" data-target="[langSelector__nav]"> <ul class="globe-list"> <li class="button-circle globe" title="Language"> <span class="icon-globe"></span></li> </ul> <span class="dropdown-label">English</span> <span class="chevron down"></span> </a> <ul class="nav nav-tabs" data-name="langSelector__nav"> <li class="tab active"> <a rel="nofollow" href="http://web.archive.org/web/20220927005144/https://ico.org.uk/" name="English" class="content language-item">English</a> </li> <li class="tab"> <a rel="nofollow" href="http://web.archive.org/web/20220927005144/https://cy.ico.org.uk/" name="Welsh" class="content language-item">Cymraeg</a> </li> </ul> </div> </div> <div class="footer-sociallinks-links footer-sociallinks-links--right column column-4"> <ul class="clearfix"> <li> <a href="http://web.archive.org/web/20220927005144/https://twitter.com/iconews" target="_blank" class="button-circle" data-item="Follow us on Twitter"> <span class="icon-twitter"></span> <span class="invisible">Follow us on Twitter</span> </a> </li> <li> <a href="http://web.archive.org/web/20220927005144/https://facebook.com/ICOnews" target="_blank" class="button-circle" data-item="Like us on Facebook"> <span class="icon-facebook"></span> <span class="invisible">Like us on Facebook</span> </a> </li> <li> <a href="http://web.archive.org/web/20220927005144/https://linkedin.com/company/information-commissioner's-office" target="_blank" class="button-circle" data-item="Connect with us on Linkedin"> <span class="icon-linkedin"></span> <span class="invisible">Connect with us on Linkedin</span> </a> </li> <li> <a href="http://web.archive.org/web/20220927005144/https://www.youtube.com/user/icocomms" target="_blank" class="button-circle" data-item="Watch us on YouTube"> <span class="icon-youtube"></span> <span class="invisible">Watch us on YouTube</span> </a> </li> </ul> </div> <div class="hiddenpanel clearfix" id="hiddenpanel-share"> <h2 class="h4">Share this page</h2> <ul class="clearfix"> <li> <a href="http://web.archive.org/web/20220927005144/https://www.reddit.com/submit?url=https:%2f%2fico.org.uk%2ffor-organisations%2fguide-to-data-protection%2fguide-to-the-general-data-protection-regulation-gdpr%2flawful-basis-for-processing%2f" target="_blank" class="button-circle"> <span class="icon-reddit"></span> <span class="invisible">Share via Reddit</span> </a> </li> <li> <a href="http://web.archive.org/web/20220927005144/https://www.linkedin.com/shareArticle?mini=true&title=Lawful+basis+for+processing&url=https:%2f%2fico.org.uk%2ffor-organisations%2fguide-to-data-protection%2fguide-to-the-general-data-protection-regulation-gdpr%2flawful-basis-for-processing%2f&source=Ico.org.uk" target="_blank" class="button-circle"> <span class="icon-linkedin"></span> <span class="invisible">Share via LinkedIn</span> </a> </li> <li> <a href="/web/20220927005144/https://ico.org.uk/cdn-cgi/l/email-protection#17287578736e2a7f636367642d3225713225717e74783978657039627c3225717178653a78657076797e6476637e78796432257170627e73723a63783a737663763a676578637274637e787932257170627e73723a63783a637f723a7072797265767b3a737663763a676578637274637e78793a657270627b76637e78793a707367653225717b766071627b3a7576647e643a7178653a676578747264647e7970322571" target="_blank" class="button-circle"> <span class="icon-envelope"></span> <span class="invisible">Share via email</span> </a> </li> </ul> </div> <a href="/web/20220927005144/https://ico.org.uk/about-the-ico/media-centre/e-newsletter/" class="footer-sociallinks-newsletter"> <span class="h4">Subscribe to our e-newsletter</span> <span class="button-circle"> <span class="icon-envelope"></span> </span> </a> <div class="footer-sociallinks-language--mobile language-dropdown-container"> <div class="language-dropdown-tab-controls dropdown"> <a href="#" class="visible-xs mobile-tabcontrol" title="Language Selector" aria-haspopup="true" aria-expanded="false" data-target="[langSelector__nav--mobile]"> <ul class="globe-list"> <li class="button-circle globe" title="Language"><span class="icon-globe"></span></li> </ul> <span class="dropdown-label">English</span> <span class="chevron down"></span> </a> <ul class="nav nav-tabs" data-name="langSelector__nav--mobile"> <li class="tab active"> <a rel="nofollow" href="http://web.archive.org/web/20220927005144/https://ico.org.uk/" name="English" class="content language-item">English</a> </li> <li class="tab"> <a rel="nofollow" href="http://web.archive.org/web/20220927005144/https://cy.ico.org.uk/" name="Welsh" class="content language-item">Cymraeg</a> </li> </ul> </div> </div> </div> <div class="container-sitemap"> <div class="container row"> <div class="column column-2"> <a href="/web/20220927005144/https://ico.org.uk/" class="footer-sitemap-logo"><span class="invisible">ICO: Information Commissioner's Office</span></a> </div> <div class="column column-2"> <h2 class="h4"><a href="/web/20220927005144/https://ico.org.uk/your-data-matters/">Your data matters</a></h2> <ul class="text-small"> <li><a href="/web/20220927005144/https://ico.org.uk/your-data-matters/official-information/">Official information</a></li> <li><a href="/web/20220927005144/https://ico.org.uk/your-data-matters/nuisance-calls/">Nuisance calls</a></li> </ul> </div> <div class="column column-2"> <h2 class="h4"><a href="/web/20220927005144/https://ico.org.uk/for-organisations/">For organisations</a></h2> <ul class="text-small"> <li><a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-data-protection/">Guide to Data Protection</a></li> <li><a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-freedom-of-information/">Guide to FOI</a></li> <li><a href="/web/20220927005144/https://ico.org.uk/for-organisations/guide-to-pecr/">Guide to PECR</a></li> </ul> </div> <div class="column column-2"> <h2 class="h4"><a href="/web/20220927005144/https://ico.org.uk/action-weve-taken/">Action we've taken</a></h2> <ul class="text-small"> <li><a href="/web/20220927005144/https://ico.org.uk/action-weve-taken/enforcement/">Enforcement action</a></li> <li><a href="http://web.archive.org/web/20220927005144/https://icosearch.ico.org.uk/s/search.html?collection=ico-meta&profile=decisions&query">Decision notices</a></li> <li><a href="/web/20220927005144/https://ico.org.uk/action-weve-taken/audits-and-overview-reports/">Audits</a></li> </ul> </div> <div class="column column-2"> <h2 class="h4"><a href="/web/20220927005144/https://ico.org.uk/about-the-ico/">About the ICO</a></h2> <ul class="text-small"> <li><a href="/web/20220927005144/https://ico.org.uk/about-the-ico/who-we-are/">Who we are</a></li> <li><a href="/web/20220927005144/https://ico.org.uk/about-the-ico/what-we-do/">What we do</a></li> <li><a href="/web/20220927005144/https://ico.org.uk/about-the-ico/media-centre/">News and events</a></li> <li><a href="/web/20220927005144/https://ico.org.uk/about-the-ico/jobs/">Careers</a></li> <li><a href="/web/20220927005144/https://ico.org.uk/about-the-ico/ico-modern-slavery-statement-2021-2022/">Modern Slavery Statement</a></li> </ul> </div> </div> </div> <div class="container-strapline"> <div class="container row"> <div class="column column-12 h4"> <p>The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.</p> </div> </div> </div> <div class="container-footerlinks"> <div class="container row"> <div class="column column-12"> <nav aria-label="footer" class="clearfix"> <a href="/web/20220927005144/https://ico.org.uk/global/copyright-and-re-use-of-materials/">© Copyright</a> <a href="/web/20220927005144/https://ico.org.uk/global/privacy-notice/">Privacy notice</a> <a href="/web/20220927005144/https://ico.org.uk/global/cookies/">Cookies</a> <a href="/web/20220927005144/https://ico.org.uk/global/disclaimer/">Disclaimer</a> <a href="/web/20220927005144/https://ico.org.uk/global/request-publications/">Publications</a> <a href="/web/20220927005144/https://ico.org.uk/global/accessibility/">Accessibility</a> <a href="/web/20220927005144/https://ico.org.uk/global/contact-us/">Contact us</a> </nav> <div class="footerlinks-phone h2"><span class="icon-phone"></span><span class="invisible">Phone:</span> 0303 123 1113</div> <div class="footer-ogl"><span class="invisible">Open Government Licence</span></div> <div class="text-small footer-ogl-info"> All text content is available under the <a href="http://web.archive.org/web/20220927005144/http://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/">Open Government Licence v3.0</a>, except where otherwise stated. </div> </div> </div> </div> </footer> <script data-cfasync="false" src="/web/20220927005144js_/https://ico.org.uk/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script type="text/html" id="CookieControlConfig"> {"apiKey":"dbf86e044f3ab8c4df852af5c7c6ceb2dd7678dd","product":"PRO","theme":"dark","position":"left","rejectButton":true,"closeStyle":"button","consentCookieExpiry":90,"initialState":"open","statement":{"description":"For more detailed information about the cookies we use, see our","name":"Cookies page.","url":"/global/cookies/","updated":"09/07/2020"},"text":{"notifyTitle":"Our use of cookies","notifyDescription":"We use necessary cookies to make our site work. We'd also like to set analytics cookies that help us make improvements by measuring how you use the site. These will only be set if you press accept","accept":"Accept all cookies","reject":"Reject all cookies","settings":"Settings","necessaryTitle":"Necessary cookies","necessaryDescription":"Necessary cookies enable core functionality such as security, network management, and accessibility. You may disable these by changing your browser settings, but this may affect how the website functions.","title":"Our use of cookies","intro":"We use necessary cookies to make our site work. We'd also like to set analytics cookies that help us make improvements by measuring how you use the site. These will be set only if you accept.","acceptRecommended":"Accept all cookies","rejectSettings":"Reject all cookies","closeLabel":"Save and close"},"branding":{"fontFamily":"Verdana, Helvetica, Arial, sans-serif","fontColor":"#FFF","fontSizeTitle":"25px","fontSizeIntro":"15px","fontSizeHeaders":"21px","fontSize":"15px","acceptBackground":"#FFF","backgroundColor":"#0276A5","toggleText":"#FFF","toggleColor":"#0276A5","toggleBackground":"#2F2F5F","removeAbout":true},"necessaryCookies":["rwe*","language","UMB_*","UMB-*","XSRF-*","__RequestVerificationToken"],"optionalCookies":[{"name":"analytics","label":"Analytics cookies","description":"We'd like to set Google Analytics cookies to help us improve our website by collecting and reporting information on how you use it. The cookies collect information in a way that does not directly identify anyone. For more information on how these cookies work please see our 'Cookies page'.","cookies":["_ga","_gid","_gali","_gat","__utma","__utmt","__utmb","__utmc","__utmz","__utmv"],"lawfulBasis":"Consent","recommendedState":true,"onAccept":"(function (w, d, s, l, i) {\n\n var f = d.getElementsByTagName(s)[0],\n j = d.createElement(s),\n dl = l != 'dataLayer' ? '&l=' + l : '';\n j.async = true;\n j.src ='http://web.archive.org/web/20220927005144/https://www.googletagmanager.com/gtag/js?id=' + i;\n f.parentNode.insertBefore(j, f);\n window.dataLayer = window.dataLayer || [];\n function gtag(){dataLayer.push(arguments);}\n gtag('js', new Date());\n gtag('config', 'UA-1036645-1',{ 'anonymize_ip': true });\n})(window, document, 'script', 'dataLayer', 'UA-1036645-1');","onRevoke":"window['ga-disable-UA-1036645-1'] = true;"}]} </script> <script src="/web/20220927005144js_/https://ico.org.uk/cassette.axd/script/9729ebe1073254a142bd2361fc0438a8167ad0c8/scripts" type="text/javascript"></script>  </body> </html>

CINXE.COM

What is personal data? | ICO