What is PII? Direct vs indirect personal data under GDPR
The term PII (personally identifiable information) is the everyday shorthand for what the EU GDPR calls "personal data" — the entry point to the whole regulation. Under Article 4(1), personal data is any information relating to an identified or identifiable natural person (GDPR.eu — what is personal data; GDPR Article 4 text). If what you collect, store, or send can be tied to a living person, the GDPR applies — and so do its transparency, security, and breach-notification duties. The practical takeaway: you do not get to decide whether data is "personal"; the definition is deliberately broad, and Recital 26 says you must consider any means reasonably likely to be used to identify someone, by you or by anyone else.
1. The GDPR definition, word for word (Art. 4(1))
'Personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Four elements do the work: "any information" (objective or subjective — opinions count), "relating to" (content, purpose, or effect), "an identified or identifiable" (you do not need a name), and "natural person" (data about companies is out; the person must be alive) (GDPR.eu; Data Protection Commission Ireland). Because the term is "any information," courts read it broadly — even a recording of when an employee starts and stops work, or an examiner's notes about a test candidate, can be personal data if the person is theoretically identifiable.
2. Direct vs indirect identifiers
An individual is directly identifiable when you can name them from the data you hold alone — a name, an account ID, a customer number. They are indirectly identifiable when identification needs one or more extra data points combined with what you have: a device fingerprint plus an IP plus a rough location, or a VIN (vehicle identification number) linked to a registration certificate (EDPB — Flightradar24 decision, recital on online identifiers).
The distinction matters because indirect identifiers are still personal data. Recital 30 explicitly lists IP addresses, cookie identifiers, and RFID tags as online identifiers that — especially when combined — can single someone out and build a profile. The CJEU has confirmed that even dynamic IP addresses are personal data for a party that has the legal means to link them to a user (Breyer, C-582/14). For a step-by-step compliance plan built on this definition, see the GDPR compliance guide for a small site or app.
3. Online identifiers: why your analytics and cookies count
Most teams underestimate how much of their site is already personal data. Under the GDPR's broad reading, the following are typically personal data because they can identify or single out a person:
- IP addresses (static or dynamic, where linkage is feasible)
- Cookie IDs and advertising/analytics identifiers
- Device and browser fingerprints
- Email addresses, phone numbers, postal addresses
- Location data and precise geolocation
- Inference data — profiles or predictions built from the above
This is why cookie banners and consent management exist in the first place (covered in the cookie consent best-practices guide) and why detecting PII exposure in your code and third-party scripts is a separate, ongoing discipline.
4. Special categories and why "PII" triggers real obligations
On top of ordinary personal data, special categories under Article 9 (racial/ethnic origin, political opinions, religious beliefs, trade-union membership, genetic, biometric, health, sex-life data) get a higher protection bar and need a separate Article 9 condition on top of an Article 6 lawful basis. And once data is personal, the obligation chain switches on: you need a lawful basis (Art. 6), a transparent privacy notice (Arts. 12–14), security measures (Art. 32), a RoPA/data inventory (Art. 30, see the data inventory best-practices guide), and breach notification (Arts. 33–34). Non-compliance can reach €20 million or 4% of global annual turnover under Art. 83.
Decision-support note. Knowing what is personal data is the first filter. A tool like PrivScan can surface likely PII exposure on a site or app and return a prioritized checklist — but it does not decide whether your processing is lawful. That call belongs to a qualified DPO or privacy counsel.