How does GDPR define personal data?
Broadly and deliberately so. Article 4(1) covers any information relating to an identifiable person — one who can be identified directly or indirectly, by reference to a name, an identification number, location data, an online identifier, or factors specific to their identity.
GDPR also defines special categories (Article 9) — health, genetic and biometric data, racial or ethnic origin, political opinions, religious beliefs, sex life and sexual orientation — which get stricter protection. And the boundary runs at anonymity: Recital 26 places truly anonymous information outside the regulation entirely, which is what makes anonymization such a central compliance tool.
How do US PII notions differ?
The US has no single definition. "PII" means different things under different laws and agency guidelines — often built around lists of identifiers such as name, social security number and biometric records, sometimes covering linkable information more broadly. Sectoral laws add their own scopes for health and financial data, and state privacy laws increasingly use a broad, GDPR-like "personal information".
| GDPR "personal data" | Typical US "PII" usage | |
|---|---|---|
| Approach | One broad definition: anything relating to an identifiable person | Varies by law and sector; often list-based |
| Online identifiers | Explicitly included (IP, cookies) when linkable | Depends on the specific law |
| Sensitive tier | Special categories, Article 9 | Sectoral regimes for health, financial and other data |
| Anonymous data | Outside scope (Recital 26) | Generally outside scope when de-identified per the applicable standard |
The practical trap: a document "cleaned" against a narrow US-style checklist — no SSN, no account number — can still be full of personal data by GDPR standards. If you serve international users, work to the broader definition.
What counts as PII in practice? Examples
The clearest way to grasp the definition is through examples. Watch the last category — indirect identifiers — because that's where most organizations slip.
- Direct identifiers — full name ("John Miller"), national ID, passport, phone number, personal email, home address, photo.
- Digital identifiers — IP address, device ID, cookie, GPS location — when they can be linked to a person.
- Special-category data — a medical diagnosis, genetic or biometric data, sexual orientation, political opinion, criminal record.
- Indirect identifiers — "the CFO of a 40-person software company in the north": no name, yet identifying. An unusual salary, a unique event date, or a role-plus-department combination can identify too.
What does this mean for using AI tools?
With a definition this broad, almost every working document — a contract, an email thread, meeting minutes, a résumé — contains personal data. Entering it into an external AI tool is processing and disclosure, with the full chain of obligations; the details are in what not to paste into ChatGPT.
The flip side: neither GDPR nor PII regimes apply to information that no longer identifies anyone. A document that has been effectively anonymized — indirect identifiers and Metadata included — falls outside the rules, and can be worked on freely in AI tools.