Glossary
Personal data
Any information relating to an identified or identifiable natural person, directly or indirectly, as defined in GDPR Article 4(1).
Personal data is defined in Article 4(1) GDPR as any information relating to an identified or identifiable natural person (the data subject). A person is identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or an online identifier. Recital 26 adds the test of "means reasonably likely to be used" to identify someone, which is why pseudonymised data remains personal data.
For security and IT teams the definition is broader than it first appears. Usernames, email addresses, device identifiers, badge logs and IP addresses in firewall or web server logs can all be personal data. In Breyer (C-582/14), the CJEU held that a dynamic IP address can be personal data for a website operator that has legal means to identify the person with additional information held by the ISP.
In practice this means SIEM platforms, EDR telemetry, backups and ticketing systems are all in GDPR scope and need a lawful basis, retention limits and access control. See our guide to security logging and monitoring for how to handle personal data in security tooling.