Personal data
Definition
Any information relating to an identified or identifiable natural person, directly or indirectly, such as a name, an identification number, location data or an online identifier.
Personal data is the central concept of data protection law: if information does not relate to an identifiable person, the GDPR and the LGPD do not apply to it. The GDPR (Art. 4(1)) and the LGPD (Art. 5, I) share the same broad logic. A person is identifiable when they can be singled out using means reasonably likely to be used, by the organisation or by anyone else, including by combining several data points.
The category is wider than most people expect. IP addresses, device identifiers, cookie IDs, voice recordings, photos, employee performance notes and inferences produced by a model about someone can all be personal data. Pseudonymized data remains personal data; only truly anonymized data falls outside the law.
In AI projects, personal data can appear in training sets, in prompts typed by users and in model outputs. A customer service chatbot that stores conversation logs linked to an account number is processing personal data and needs a lawful basis, a defined purpose and a retention period.
Where this term is assessed
Assessed in the Data Protection & AI Professional (DPAI), domain 1: Data protection foundations.
Also covered in: Responsible AI Foundation (RAIF)
Primary sources
- GDPR Art. 4(1)
- LGPD Art. 5, I