Glossary · Rules and compliance
Personal data
Personal data is information relating to an identified or identifiable living person. It includes obvious identifiers such as a name or photograph, but also details that can reveal who someone is when combined, even if the document you use does not state their identity directly.
Personal data: the explanation
Some information identifies someone directly, such as a name linked to a home address. Other information contributes to identification when combined with further details. In a conversation with an agent, a workplace, job title and description of an incident may reveal a person’s identity. You therefore need to consider context and realistic possibilities of linking information together. Searching only for names in an attachment can miss details that still make a person identifiable to others.
The concept helps determine when data protection rules may apply. It covers information you enter yourself as well as material in attachments or retrieved through connected tools. An agent with access to your calendar may encounter information about colleagues, clients or family members. The European Commission explains the definition here: https://commission.europa.eu/law/law-topic/data-protection/information-business-and-organisations/application-gdpr_en. Information can remain personal data when it is publicly accessible, so finding a detail online does not by itself remove the need to assess its use.
Different kinds of personal data can attract different requirements. Certain categories, including health information, receive particular protection. Replacing a name with a reference number does not necessarily make a file anonymous, because someone may still be identifiable. Encrypted information can also remain personal data if it can be linked to an individual. When using AI, examine the content and its context, including what additional information could realistically allow someone to recognise the people concerned.
A concrete example
You ask an assistant to summarise a customer complaint. You remove the customer’s name, but the message still contains a delivery address, an order reference and a detailed account of what happened. Those details may identify the customer. You prepare a shorter extract focused on the problem and check whether each remaining piece of information is needed before sending it to the tool.
Why it matters
Recognising personal data helps you decide what to share with an agent and which permissions to grant. Business documents can contain information about other people as well as your own. Before connecting an inbox or shared drive, examine the information available, whether it is needed for the task and how it will be retained. This matters even when you enter no names.
Common misconceptions
- Information found on a public website can still be personal data, because public availability does not remove its connection to an identifiable person or automatically remove the rules that govern collecting it and using it elsewhere.
- Removing names does not always anonymise a document, because a combination of locations, dates, job roles or other distinctive details may still allow someone to recognise a person using the remaining information and other available sources.
Related terms: rules and compliance
Where this site covers it
The term appears on 518 pages of this site. A few of them:
- AI Act: a compliance checklist for businesses using AI agents and tools Guide
- Writing your company’s AI use policy: what to include, sample rules, and rollout Guide
- Writing AI agent instructions: system prompts, AGENTS.md and CLAUDE.md files, and examples Guide
- Voice agents: how they work, platforms, latency, costs, and use cases Guide
- Deploying AI agents in business: use cases, selection, pilots, governance, and measurement Guide
- Monitoring an AI agent in production: logs, traces, alerts, and observability tools Guide
- Securing an AI agent: permissions, secrets, sandboxing, human approval, and logging Guide
- AI agents and the GDPR: what data leaves, and where does it go? Article
Go further
Frequently asked questions
Does a work email address count?
A work email address that identifies an individual is generally personal data. A generic organisational address can present a different situation. Consider whom the address refers to and whether the surrounding context allows a person to be identified.
Can incorrect information be personal data?
Yes. False information, including a statement generated by AI, can still concern an identifiable person. Being inaccurate does not remove that connection. You should therefore assess generated answers as well as the information supplied to the tool.
What is pseudonymisation?
Pseudonymisation replaces or separates identifying elements to reduce a direct connection with someone. Additional information can still allow identification. It can provide useful protection, but does not automatically turn the resulting information into anonymous data outside data protection rules.
Neutrality. No affiliate links. No vendor pays to be reviewed, rated or ranked. Reviews are directed by François Chollet, neutral and factual, and every data point is dated and sourced. How we score