.png)
What Is Personal Data Under UK GDPR Examples Every Organisation Should Know
Misunderstanding personal data is one of the fastest ways for an organisation to fall short of UK GDPR requirements. If a record, message, image, spreadsheet, system log, or note can identify a living person, it may bring legal responsibilities with it.
That matters for every organisation, not only large companies. A small business holding customer email addresses, an HR team managing absence records, a charity supporting service users, or an NHS provider handling patient information all process information about people every day.
Under the UK GDPR, the starting point for compliance is simple: know what personal data is, where it sits, why you hold it, who can access it, and how long you keep it.
This guide explains the meaning of personal data, gives practical personal data examples, and highlights common mistakes that can create data protection risk.
What is personal data under UK GDPR?
Under the UK GDPR, personal data means any information relating to an identified or identifiable living individual.
In plain English, information is personal data if it is about a person and that person can be identified from it, either directly or indirectly.
A person may be directly identified by obvious details such as their name or photograph. They may also be indirectly identified through a combination of details, such as job title, location, date of birth, reference number, or online identifier.
For example, “Sarah Ahmed, Finance Manager” clearly identifies someone in many organisations. But “the only Finance Manager at a small charity in Leeds who was off sick in March” may also identify a person, even without naming them.
What makes personal data identifiable?
Identifiability is wider than many organisations realise. You do not need to know a person’s name for information to count as personal data.
A person may be identifiable through:
A name
A home address
An email address
A phone number
A staff or patient number
A photograph
CCTV footage
Location data
Device identifiers
Payroll records
Case notes
Voice recordings
Online account details
The test is whether someone can be identified by using the information available, including information that could reasonably be combined with it.
For example, an IP address might not tell a staff member a person’s name at first glance. But if it can be linked to account records, device logs, or user activity, it may become identifiable information.
This is why ICO guidance encourages organisations to look at context. A single piece of information may seem harmless in isolation, but become personal information when matched with other records.
Common personal data examples every organisation should recognise
Personal data appears in more places than most organisations expect. It is not limited to HR files or customer databases. It can exist in emails, forms, CCTV systems, spreadsheets, case management systems, rota software, complaints logs, and handwritten notes.
Names
A person’s name is one of the clearest examples of personal data, especially when combined with another detail such as workplace, address, role, or service history.
A name in a visitor book, staff record, patient file, volunteer register, or customer account will usually be personal data.
Email addresses
Personal email addresses such as `name@example.com` will usually identify a person.
Work email addresses can also be personal data. An address such as `alex.smith@company.co.uk` clearly relates to an individual, even though it is used for work.
Generic inboxes such as `info@company.co.uk` are less likely to be personal data if they do not identify a person. But if access logs or usage records link the inbox to a named employee, related information could still become personal data.
Phone numbers
Mobile numbers, direct dial numbers, and emergency contact numbers can identify individuals. This includes staff contact lists, customer call records, patient contact details, and volunteer databases.
Even where a number is not labelled with a name, it may still relate to a person if the organisation can connect it to account records or call histories.
Employee records
HR teams process large volumes of personal data. Common examples include:
Employment contracts
Payroll details
Bank details
National Insurance numbers
Performance records
Disciplinary records
Absence notes
Right to work checks
Training records
Emergency contacts
Some employee records also include special category data, such as health information in occupational health reports or sickness records.
Patient and service user information
NHS bodies, healthcare providers, care services, and charities often handle sensitive information about people receiving care or support.
Patient information may include symptoms, diagnoses, treatment plans, appointment notes, prescriptions, referrals, NHS numbers, and safeguarding information.
Even administrative information, such as appointment times or clinic attendance, may be personal data because it relates to an identifiable person and their use of a service.
IP addresses and online identifiers
Online identifiers can count as personal data when they relate to identifiable users.
Examples include:
IP addresses
Cookie identifiers
Device IDs
Account IDs
Login records
App usage data
Location tracking data
Web analytics, client portals, online booking systems, and staff monitoring tools may all collect online identifiers. Organisations should understand what these tools collect and whether users have been given clear privacy information.
CCTV footage
CCTV images are personal data where individuals can be identified from the footage. This applies to cameras in shops, clinics, community centres, reception areas, warehouses, car parks, schools, and public buildings.
CCTV also raises wider compliance issues, including signage, retention periods, access controls, subject access requests, and proportionality.
What is not considered personal data?
Not all information falls under the UK GDPR. The key question is whether a living individual can be identified.
Information is less likely to be personal data if it has been truly anonymised, aggregated, or separated from any realistic route back to an individual.
Anonymous information
Anonymous information is information that no longer identifies a person and cannot reasonably be used to identify them.
True anonymisation is difficult. Removing names is not always enough. If the remaining details still point to a person, the information may still be personal data.
For example, replacing names with initials in a small team absence report may not anonymise the data if colleagues can still work out who is being discussed.
Aggregated statistics
Grouped statistics are usually not personal data if they do not identify individuals.
For example:
“42 people attended training this month”
“15 complaints were received in quarter one”
“The average waiting time was 8 days”
“30% of staff completed the survey”
By contrast, statistics based on very small groups can still create identification risk. “One person in the senior leadership team reported a disability” may identify someone if the group is small enough.
Information that cannot identify an individual
Information about companies, buildings, stock levels, or general operations is not personal data unless it connects to an identifiable living person.
For example, “ABC Ltd has 20 vans” is not usually personal data. “Driver 14 used van 6 between 8:00 and 10:00” may be personal data if Driver 14 can be linked to a named employee.
Special category data explained
Special category data is personal data that needs extra protection because it is more sensitive and could create greater risk if misused.
Under the UK GDPR, special category data includes information about a person’s:
Health
Racial or ethnic origin
Religious or philosophical beliefs
Biometric data used for identification
Genetic data
Political opinions
Trade union membership
Sex life or sexual orientation
Criminal offence data is dealt with separately under the UK GDPR and Data Protection Act 2018, but it also needs careful handling.
Health data
Health data includes much more than medical records. It can include sickness absence notes, occupational health reports, disability adjustments, medication information, counselling notes, and care plans.
For NHS and healthcare organisations, health data sits at the heart of service delivery. For employers, charities, and schools, it can appear in routine records and case files.
Ethnicity, religion, and political opinions
Equality monitoring forms, service user assessments, staff surveys, and membership records may collect information about ethnicity, religious beliefs, or political opinions.
Organisations should be clear about why they collect this information, whether it is necessary, and what lawful basis and special category condition apply.
Biometric data
Biometric data includes physical or behavioural characteristics used to identify a person, such as fingerprints, facial recognition templates, iris scans, or voice recognition patterns.
A simple photograph is personal data. It becomes biometric data under the special category rules when it is processed using specific technical means to uniquely identify someone.
Why special category data needs extra protection
Special category data can reveal intimate details about a person’s identity, health, beliefs, or private life. If mishandled, it can cause distress, discrimination, financial harm, reputational damage, or loss of trust.
Organisations should apply stronger controls, including:
Clear access restrictions
Documented lawful basis and condition for processing
Shorter retention where appropriate
Staff training
Secure sharing methods
Data protection impact assessments for higher-risk processing
Common personal data mistakes organisations make
Many GDPR compliance problems begin with everyday assumptions rather than deliberate misuse. The following mistakes are common across SMEs, charities, public bodies, HR teams, and care providers.
Assuming work emails are not personal data
A work email address that identifies a person is still personal data. The same applies to email content that discusses an employee, customer, patient, volunteer, trustee, or service user.
This means that access, retention, monitoring, and disclosure of email records need proper controls.
Collecting more information than necessary
One of the core data protection principles is data minimisation. Organisations should only collect information they genuinely need for a clear purpose.
For example, a basic event sign-up form may need a name and email address. It may not need date of birth, home address, job title, dietary details, and emergency contact information unless there is a specific reason.
Keeping data longer than necessary
Old records create risk. If information no longer serves a lawful purpose, keeping it “just in case” can breach data protection principles.
Retention schedules help organisations decide how long to keep different categories of information, such as HR records, safeguarding files, financial records, complaints, CCTV footage, and customer accounts.
Sharing information without a lawful basis
Personal information should not be shared simply because another person or organisation asks for it. There must be a lawful basis, a clear purpose, and appropriate safeguards.
Common risk areas include:
Sending HR records to managers who do not need them
Sharing service user details by unsecured email
Giving information to third parties without checking authority
Discussing identifiable cases in open spaces
Copying too many recipients into emails
How organisations can identify and manage personal data
Good data protection starts with visibility. If you do not know what information you hold, you cannot manage it safely.
A practical approach includes the following steps.
Map where information is held
Create a record of the systems, folders, forms, inboxes, devices, and paper files that contain personal data.
Include less obvious places, such as shared drives, archived email accounts, CCTV systems, spreadsheets, messaging platforms, and legacy databases.
Classify the type of data
Separate ordinary personal data from special category data and criminal offence data. This helps you apply the right level of control.
For example, a staff rota may need basic protection. A staff rota that includes sickness reasons or disability adjustments needs stronger handling.
Check the purpose and lawful basis
Every processing activity should have a clear purpose and lawful basis. For special category data, you also need a separate condition.
This is central to GDPR compliance and should be reflected in privacy notices, policies, and internal records.
Limit access
People should only access the information they need for their role. Access controls are especially important for HR files, patient records, safeguarding notes, payroll data, and complaint files.
Review access regularly, especially when staff change roles or leave.
Review retention and deletion
Set retention periods and follow them. Deleting information safely is as important as storing it securely.
This applies to both digital and paper records. Archived boxes, old laptops, USB drives, and exported spreadsheets can all contain personal data.
Train staff with realistic examples
Training works best when it reflects real situations. Use examples from HR, customer service, care delivery, fundraising, finance, operations, and governance.
Staff should know how to recognise personal data, spot special category data, report incidents, and handle requests from individuals.
FAQ
Is a name always personal data?
A name is usually personal data when it relates to a living person who can be identified. In some cases, a common first name on its own may not identify anyone, but context can quickly change that.
Are work contact details personal data?
Yes, work contact details can be personal data if they identify an individual. This includes named work email addresses, direct phone numbers, staff profiles, and role-based records linked to a person.
Is CCTV footage personal data?
Yes, CCTV footage is personal data if people can be identified from it. Organisations using CCTV should have clear signage, a lawful purpose, suitable retention periods, and controls over access.
What is the difference between personal data and special category data?
Personal data is any information relating to an identifiable living person. Special category data is a more sensitive type of personal data, such as health data, ethnicity, religious beliefs, biometric data, or political opinions.
Does anonymised data fall under UK GDPR?
Truly anonymised data does not fall under the UK GDPR if individuals cannot be identified from it. Pseudonymised data, where identifiers are replaced but re-identification is still possible, remains personal data.
Personal data should be easy to recognise and carefully managed
Understanding personal data is the foundation of good data protection. Once an organisation can identify what information relates to living people, it can make better decisions about collection, access, retention, sharing, security, and individual rights.
The safest approach is to treat identifiability as a practical question. Could someone be recognised from this information, either directly or by combining it with other details? If the answer is yes, UK GDPR duties are likely to apply.
For organisations handling employee records, patient information, service user files, customer details, CCTV, or online identifiers, clarity is essential. Accurate data mapping, staff training, clear policies, and regular reviews all reduce risk and support better compliance.
Comments