Which data are not considered personal data under the GDPR?

Asked by: King Moen  |  Last update: May 6, 2026
Score: 4.9/5 (41 votes)

Data not considered personal under GDPR includes truly anonymous data, information about legal entities (companies, foundations), data related to deceased individuals, and data processed for purely personal/household activities; essentially, anything not linked to an identifiable living person, like aggregated statistics, public authority data, or general business info (e.g., info@company.com).

Which data is not considered personal data under the GDPR?

By using “natural person,” the GDPR is saying data about companies, which are sometimes considered “legal persons,” are not personal data. A final caveat is that this individual must be alive. Data related to the deceased are not considered personal data in most cases under the GDPR.

What is not a personal data in GDPR?

In terms of origin, non-personal data can be data which never related to natural persons (such as data on weather or supply chains), or data which was initially personal data, but has been anonymised (through use of certain techniques to ensure that individuals to whom the data relates to cannot be identified).

Which is not classed as personal data beneath the GDPR?

Information concerning a 'legal' rather than a 'natural' person is not personal data. Consequently, information about a limited company or another legal entity, which might have a legal personality separate to its owners or directors, does not constitute personal data and does not fall within the scope of the UK GDPR.

Which is considered personal data under GDPR?

In practice, these also include all data which are or can be assigned to a person in any kind of way. For example, the telephone, credit card or personnel number of a person, account data, number plate, appearance, customer number or address are all personal data.

What is Considered Personal Data Under the GDPR?

35 related questions found

What are 5 examples of personal data?

What is personal data?

  • a name and surname.
  • a home address.
  • an email address such as 'name.surname@company.com '
  • an Internet Protocol (IP) address.
  • an identification card number.
  • a cookie ID.
  • the advertising identifier of your phone.
  • data held by a hospital or doctor, which could be a symbol that uniquely identifies a person.

What are the 7 principles of GDPR?

The 7 principles of GDPR (General Data Protection Regulation) are: Lawfulness, Fairness & Transparency (process data legally, fairly, openly); Purpose Limitation (use data only for specified, legitimate reasons); Data Minimisation (collect only necessary data); Accuracy (keep data correct and up-to-date); Storage Limitation (don't keep data longer than needed); Integrity & Confidentiality (secure the data); and Accountability (demonstrate compliance).
 

Which of the following data is not considered personal data?

What is NOT considered personal data: Data related to the deceased. Inaccurate data that can't be identified to an individual. Information about legal entities.

Are photos personal data under GDPR?

The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.

What is considered non-personal data?

Non-personally identifiable information (non-PII) is data that cannot be used on its own to trace, or identify a person. Examples of non-PII include, but are not limited to: Aggregated statistics on the use of product/service. Partially or fully masked IP addresses.

What is and isn't personal information?

Personal data is defined under Section 59.1-571 of the CDPA as: … any information that is linked or reasonably linkable to an identified or identifiable natural person. But it excludes any de-identified or publicly available information.

Which of the following is not PII?

Explanation: A trade secret is not PII. PII is information that you can use to uniquely identify an individual. PII includes names, addresses, Social Security and driver's license numbers, financial account information, health records, and credentials.

What are the 7 data subject rights under GDPR?

The GDPR has a chapter on the rights of data subjects (individuals) which includes the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object and the right not to be subject to a decision based solely on automated ...

Is anonymised data still personal data?

Fully 'anonymised' data does not meet the criteria necessary to qualify as personal data and is therefore not subject to the same restrictions placed on the processing of personal data under the General Data Protection Regulation (GDPR). Data can be considered 'anonymised' when individuals are no longer identifiable.

What is considered a personal data breach under GDPR?

What is a personal data breach? A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This includes breaches that are the result of both accidental and deliberate causes.

What is not personal data under GDPR?

Information about companies or public authorities is not personal data. However, information about individuals acting as sole traders, employees, partners and company directors where they are individually identifiable and the information relates to them as an individual may constitute personal data.

Is a picture considered personal data?

The GDPR does not explicitly include a photograph as part of the definition of PII. However, any information that can be used to identify an individual, such as a facial image, may be considered personal data depending on its context and purpose.

What are the 6 legal bases of GDPR?

Article 6 of the General Data Protection Regulation (GDPR) sets out what these potential legal bases are, namely: consent; contract; legal obligation; vital interests; public task; or legitimate interests.

Is a phone number considered personal data?

Examples of personally identifiable information (PII) include: Social security number (SSN), passport number, driver's license number, taxpayer identification number, patient identification number, and financial account or credit card number. Personal address and phone number.

What are 5 examples of personal information?

Five examples of personal information include your full name, home address, date of birth, Social Security Number (SSN), and email address, but it also extends to things like your phone number, financial details (bank accounts), biometric data (fingerprints), medical records, and online identifiers (IP address) that can identify you. 

Is voice recording personal data?

To conclude, voice recordings (combined, if necessary, with other elements) enable, in almost all circumstances, the inference of one's identity and therefore constitute personal data requiring appropriate protection.

What are the 7 main principles of personal data processing?

This section presents the seven principles governing the processing of personal data and set out in article 5 of the GDPR: (1) lawfulness, fairness and transparency; (2) purpose limitation; (3) data minimisation; (4) accuracy; (5) storage limitation; (6) integrity and confidentiality; (7) accountability.

What data is protected by GDPR?

The EEA GDPR and the UK GDPR apply to all "personal data,” which includes any information relating to a living, identified or identifiable person. Examples include name, SSN, other identification numbers, location data, IP addresses, online cookies, images, email addresses, and content generated by the data subject.

What are the exemptions to GDPR?

Key GDPR exemptions relate to: special purposes (archiving, research, statistics), household and personal use, law enforcement and crime prevention, and national and public security. Even if an exemption applies, organizations must generally still uphold the core GDPR principles.

What are five examples of data?

Solution:

  • Number of houses in our housing society.
  • Monthly grocery expenses of our home.
  • Number of people who have used e-services of the state govt. over a year.
  • Number of students who have enrolled for the Math Olympiad in our school.
  • Population increase over the decade in our city.