The term personal data is legally defined in the General Data Protection Regulation (GDPR) in Article 4 No. 1.

According to Art. 4 No. 1 DSGVO, personal data are

• any information relating to an identified or identifiable natural person ("data subject").

(an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to that person).

• which are an expression of the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Since the GDPR speaks of "any information" about a person, the term "personal data" is to be interpreted very broadly.

For example, written performances of examinees are also personal data if an inference can be drawn about the identity of the examinee on the basis of the further information provided in the context of the examination (e.g. via the matriculation number) (ruling of the European Court of Justice of 20.12.2017, ref.: C-434/16).

Thus, even an indirect assignment does not exclude the characteristic of "personal identity". For this reason, so-called "pseudonymisation" does not lead to the elimination of the personal reference.

Personal reference can also exist by means of a combination of different data that would not in itself have any personal reference.

For example, the date "president" does not refer to a person because there is more than one person who holds this function or office title. However, if the respective institution is added, in this example "University of Oldenburg", the data combination "President, University of Oldenburg" results. There is therefore a reference to a person due to the combination of the data records. This is because a person can now be identified from the data. It is identifiable by merely googling or one's own knowledge. Therefore, in this example, the GDPR and the Lower Saxony Data Protection Act (NDSG) would have to be observed and complied with.

Typical personal data includes

• Name
• Address
• Telephone number
• Date of birth
• Gender
• E-mail contact details
• Personnel number
• Patient number
• Matriculation number
• Tax identification number
• Account details
• Photographs
• Video recordings
• X-ray images
• Tape recordings
• IP addresses
• Location data
• Testimonials

Categories of data may include, for example:

• Contact data (name, address, email address, telephone numbers).
• general personal data (name, date of birth, age, place of birth, address, email address, telephone number, photograph, education, occupation, marital status, nationality, holiday plans, etc.)
• identification numbers (national insurance number, tax identification number, health insurance number, identity card number, matriculation number, etc.)
• Demographic data (age, gender)
• Bank details
• Student data (attendance at events, grades)
• Online data (IP address, websites accessed, documents downloaded, time of access, access duration, terminal device used, operating system, browser, etc.)
• Ownership characteristics (ownership of a property, vehicle owner/holder, vehicle registration number, chassis number, etc.)
• Value judgements (school report, employer's reference, etc.)
• Factual circumstances (income, salary group, assets, debts, etc.)