If you’ve ever tried to read a privacy policy, you’ve probably hit that moment where your eyes glaze over and you think, “Okay, but what actually counts as personal data?”
It’s a fair question. The term gets thrown around constantly by companies, governments, apps, and anyone talking about online safety, but the definition can feel slippery. Some things are obviously personal (your name, your address), but others are less clear. Is your IP address personal data? What about your shopping habits? Or the way you scroll on a website?
What You Need to Know
- Personal data is anything that can identify you directly or indirectly.
- It includes information about you, your behaviour, and your devices, plus things like location, habits, opinions, and biometrics.
- Some data is highly sensitive (“special category data”) and gets extra legal protection.
- Companies collect personal data because it’s valuable for profiling, targeting, and predicting behaviour.
- Understanding what counts as personal data helps you protect yourself and your children in a world where small signals reveal a lot.
The Simple Definition
Under laws like the GDPR, personal data means:
Any information that can identify you, either directly or indirectly
That’s it, but that tiny sentence covers a huge amount of information.
There are two big ideas hidden inside it:
Direct identification
This is the obvious stuff. The information that points straight to you with no need for anything else.
Examples include your:
- Full name
- Home address
- Phone number
- Email address
- Passport number
If someone has this information, they know exactly who you are.
Indirect identification
This is where things get interesting. Information that on its own doesn’t identify you but combined with other data it absolutely could.
Examples include your:
- IP address
- Device ID
- Location history
- Browsing behaviour
This is why companies can say “we don’t know your name” while still tracking you across the internet. They don’t need your name; your device, habits, and patterns are your identity.
The Three Big Categories of Personal Data
To make sense of it all, it helps to group personal data into three buckets.
1. Information about you
This is the classic stuff, the details you’d expect to be personal.
Examples:
- Name
- Address
- Date of birth
- Gender
- Phone number
- Email address
- Photos of you
- Your voice in a recording
If it describes you as a person, then it’s personal data.
2. Information about your behaviour
This is where modern data collection really exploded. Companies don’t just want to know who you are; they want to know what you do.
Examples:
- What you click on
- How long you spend on a page
- What you search for
- What you buy
- What you watch
- What you “like”
- What time of day you’re active
This is the data that powers personalised ads, recommendations, and those eerily accurate predictions about what you’ll want next.
3. Information about your devices
Your phone, laptop, tablet, smart speaker, TV — they all generate data that can be linked back to you.
Examples:
- IP address
- Device ID
- Advertising ID
- Browser type
- Operating system
- Screen size
- Wi-Fi network name
- Bluetooth beacons nearby
Individually, these seem harmless. Together, they create a fingerprint that’s surprisingly unique.
The Surprising Things That Also Count as Personal Data
Some types of information don’t feel personal at first glance, but they absolutely are.
Your location
Even a rough location (like your town) can identify you when combined with other data. Precise location (like GPS) is extremely sensitive.
Your online identifiers
Cookies, tracking pixels, and analytics IDs are all personal data because they follow you across websites.
Your opinions
If they can be linked to you — for example, through a survey or account — they’re personal data.
Your habits and routines
Wake-up times, commute patterns, shopping cycles, and exercise routines are all personal data.
Your children’s data
Children’s data is treated as extra sensitive because kids can’t meaningfully consent.
Your biometric data
This includes:
- Face recognition
- Fingerprints
- Voiceprints
- Gait (the way you walk)
- Typing rhythm
Yes, even how fast you type can identify you.
The “Special Category” Data That Gets Extra Protection
Some types of personal data are considered highly sensitive because they reveal intimate details about your life.
These include:
- Health information
- Genetic data
- Biometric data used for identification
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Sexual orientation
Companies need a much stronger legal reason to collect or use this kind of data.
Personal Data Doesn’t Have to Be True
This is weird but important. If a company has incorrect information about you, for example, a wrong address or an outdated profile, it’s still personal data. Why? Because it’s data about you, even if it’s wrong. Therefore, you have the right to correct inaccurate information.
Personal Data Doesn’t Have to be Collected Online
We often think of personal data as something apps and websites gather, but it also includes:
- Paper forms
- CCTV footage
- Phone call recordings
- In-store loyalty cards
- Delivery notes
- Customer service logs
If it’s information about you, it counts.
When Does Data Stop Being Personal?
There are two key terms here:
Anonymised data
This is data that has been stripped of all identifiers and cannot be linked back to you, even with additional information.
True anonymisation is hard.
Most companies claim to anonymise data when what they’re actually doing is:
Pseudonymisation
This means they mask or replace your data with an ID, but they can still link it back to you behind the scenes.
Example:
A company replaces your name with “User 12345”.
They still know who User 12345 is, so it’s still personal data.
Why Companies Want Your Personal Data So Much
Personal data has become one of the most valuable resources in the digital world. Every time you browse, tap, scroll, or sign up for something, companies learn a little more about who you are, what you like, and how you behave. And the more they know, the more they can shape your experience — and their profits.
That’s why so many businesses collect as much data as they can. It helps them:
- Personalise your experience
- Target ads
- Improve products
- Predict behaviour
- Sell insights to third parties
- Build detailed customer profiles
- Optimise pricing
- Measure performance
While some of it is harmless and some is helpful, some of it is…less so. The important thing is knowing what’s being collected so you can make informed choices.
Why Understanding Personal Data Matters for Families
When you’re a parent, personal data isn’t just about you anymore; it’s about your children too. Kids grow up surrounded by apps, games, smart devices, and online platforms that quietly collect information in the background. And because children can’t fully understand what they’re sharing or how long it lasts, their data needs extra care and protection.
Children’s data is:
- More sensitive
- More easily misused
- More permanent (kids can’t “start fresh” online)
- More attractive to advertisers
- More protected by law
Many apps aimed at children collect far more data than parents realise, especially free games, educational apps, and YouTube-style platforms.
Knowing what counts as personal data helps you spot red flags early.
How to Tell if Something is Personal Data (A Simple Test)
Ask yourself: “Could this information identify me, either on its own or when combined with other data?”
- If the answer is yes, it’s personal data.
- If the answer is maybe, treat it as personal data.
- If it can’t identify you by itself but could when matched with other information, it’s still personal data.
A Quick Cheat‑Sheet You Can Use Anytime
Personal data includes:
- Your name
- Your contact details
- Your photos
- Your voice
- Your location
- Your device identifiers
- Your browsing behaviour
- Your purchase history
- Your social media activity
- Your health information
- Your children’s data
- Anything that can be linked back to you
Personal data does not include:
- Fully anonymised data
- Aggregated data that can’t be traced to individuals
Everything else, then assume it’s personal.
If You Only Remember One Thing…
Personal data is anything that can identify you, either on its own or when combined with other information. If it could point back to you, treat it as personal data.
What to Remember
Personal data isn’t just your name, address, or phone number anymore. Today, it includes your habits, your devices, your patterns, your preferences, your movements, your voice, your face, even the way you scroll, pause, or interact with a screen. Combined, these small signals create a surprisingly detailed picture of who you are and how you live.
Understanding what counts as personal data gives you real power. It helps you make smarter choices, protect your family, and stay in control of your digital life. It also makes it easier to spot when something feels off. When an app is asking for too much, when a service is tracking more than it needs, or when a “free” product is quietly collecting information in the background.
Once you know what companies can gather, and how much they can infer, you’re in a far stronger position to decide what you’re comfortable sharing, what you want to limit, and what you’d rather keep private.