Glossary · Glossary · GDPR concepts
Personal data: what it is and where it hides in your documents
Anonimatum Team
In short
Personal data is any information relating to an identified or identifiable living person, directly or indirectly: a name, an ID number, a number plate, a signature or a set of details that together reveal who someone is.
The whole GDPR rests on one concept: personal data. If information qualifies, the UK GDPR and Data Protection Act 2018, or the EU GDPR, apply; if not, they do not. So before publishing, sharing or anonymising a document, the first question is always what personal data it contains.
The legal definition is deliberately broad. It is not limited to names and ID numbers. It covers any information that can identify someone, including pieces that look harmless on their own but reveal a person when combined.
The Article 4(1) GDPR definition
The GDPR defines personal data as any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or an online identifier, or to factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity. The UK GDPR and the Data Protection Act 2018 use the same concept, limited to living individuals.
How to decide whether someone is identifiable is explained in GDPR Recital 26: consider all the means reasonably likely to be used, taking into account cost, time and available technology.
Direct and indirect identifiers
Direct identifiers point to a person on their own: full name, passport or National Insurance number, NHS number, a photo of their face. Indirect identifiers are not enough in isolation but give people away in combination: date of birth, postcode, occupation, job title, workplace, dates of a specific event. A fictitious report mentioning “the ward sister on the children’s ward of the local hospital in 2024” identifies someone without naming them.
Examples of personal data in documents
| Data | Where it usually appears | Type |
|---|---|---|
| Full name | Headers, body text, signatures, letters | Direct |
| Passport, National Insurance or ID number | Contracts, forms, applications | Direct |
| Home address | Letters, minutes, invoices | Direct or indirect |
| Vehicle registration | Police reports, traffic cases, fines | Indirect |
| Handwritten or digital signature | End of contracts and decisions | Direct |
| Case reference or patient number | Decisions, medical reports | Indirect |
| Phone, email, bank details | Invoices, payslips, emails | Direct or indirect |
| Author and organisation in metadata | PDF or Word properties | Direct |
Some categories get extra protection: health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic and biometric data, sex life or sexual orientation. These are the special categories of data under Article 9.
What is not personal data
- Information about companies and other legal persons, such as a company name or registration number (Recital 14). An employee’s or sole trader’s name and email are personal data, though.
- Anonymous information, or data anonymised so that individuals are no longer identifiable.
- Data about deceased people, which falls outside the UK and EU GDPR (Recital 27), although confidentiality duties may still apply.
- Aggregate statistics from which no individual can be singled out.
Pseudonymised data, by contrast, is still personal data: swapping a name for a code is not enough if someone keeps the lookup table. The difference is explained under anonymisation.
Personal data vs PII in the US
In the United States there is no single equivalent to the GDPR. The term PII (personally identifiable information) is common; NIST guidance describes it as information that can distinguish or trace an individual’s identity, plus information linked or linkable to them. Sector laws use their own terms, such as protected health information under HIPAA. In practice, personal data under the GDPR is usually the broader notion.
Finding personal data before you share
Searching a hundred-page file by hand is slow and error-prone, especially with scans, stamps and attachments. Anonimatum detects names, organisations, dates, addresses, amounts, number plates, QR codes and signatures with its own AI on EU servers, plus patterns such as ID numbers, IBAN, phone and email. Everything is reviewed before it is applied; a simple place to start is hiding ID numbers in a PDF.
Frequently asked questions
Is an IP address personal data?
It can be. In Breyer (C-582/14) the Court of Justice held that a dynamic IP address is personal data where the holder has legal means to identify the user.
Is a work email like firstname.lastname@company.com personal data?
Yes, because it identifies a specific individual, even in a work context. A generic address such as info@ usually is not.
Are initials personal data?
Yes, if the context reveals who they refer to, which is common in documents with dates, places or job titles.
Can PDF metadata contain personal data?
Yes. The author, organisation or last editor is often stored in the document properties.
Find the personal data in your documents
See the plans and start detecting and removing personal data in PDF, Word, Excel and email files, with human review before anything is applied.