Personal data only includes information relating to natural persons who can be identified or who are identifiable, directly from the information in question; or who can be indirectly identified from that information in combination with other information.
An individual is ‘identified’ or ‘identifiable’ if they can be distinguished from other individuals. A name is perhaps the most common means of identifying someone. However, whether any potential identifier actually identifies an individual depends on the context. A combination of identifiers may be needed to identify an individual. The list of identifiers, includes name; identification number; location data; and an online identifier. The term ‘Online identifiers’ includes IP addresses and cookie identifiers which may be personal data.
A key principle of date protection is that any processing of personal data must be done securely by means of appropriate technical and organisational measures.