Home / Blog / Website Security / What is personal data under GDPR, and what does a compliance statement look like?

Answers

What is personal data under GDPR, and what does a compliance statement look like?

16 October 2026 · By John Carlsson

Under GDPR, personal data is information that relates to an identified or identifiable living person, directly or when combined with other information. Names, ID numbers, location data and online identifiers such as IP addresses and cookie IDs can all qualify. A compliance statement is usually a privacy notice explaining why you process data, how long you keep it and who you share it with.

This article explains official guidance in plain terms and is not legal advice. The EU GDPR applies across the European Union, and the UK has its own UK GDPR alongside it. The definition of personal data is the same in substance in both, and the examples below draw on the regulation itself and on guidance from the ICO, the UK regulator.

When does information count as personal data?

Personal data is information that relates to an identified or identifiable living person. It covers natural persons only, so information about a company or a public authority is not personal data in itself. Information about a sole trader, an employee or a company director can be, when it is about them as an individual and they can be identified.

The key test is whether you can tell one person apart from others. The ICO describes two routes:

Directly identifiable: the information alone distinguishes the person, even without a name.
Indirectly identifiable: the information does so when combined with other information you hold or could obtain.

Context matters. A detail that means nothing on its own can identify someone when put alongside other details.

Which website data can be personal data?

The law gives examples of identifiers, including a name, an identification number, location data and an online identifier. Recital 30 of the GDPR explains that people may be associated with online identifiers provided by their devices, applications, tools and protocols, and that these can leave traces which, combined with other information, may be used to profile and identify them. The ICO notes that IP addresses and cookie identifiers may be personal data.

For a typical website, that means you should think carefully about:

Contact form and newsletter sign-up details, such as names and email addresses.
Customer accounts and order records.
Server logs that record IP addresses.
Analytics and advertising cookies that assign an identifier to a visitor.

Is pseudonymised or anonymised data still covered?

Pseudonymised data, where identifiers are removed or replaced, lowers the privacy risk but is still personal data. Recital 26 of the GDPR says that data which could be linked back to a person using additional information should be treated as information on an identifiable person. Truly anonymised data, where a person can no longer be identified, falls outside the law.

Some personal data is more sensitive. The ICO explains that special category data, together with criminal offence data, can only be processed in more limited circumstances. If your site collects anything in these areas, read the official guidance before you start.

What does a GDPR compliance statement look like?

The GDPR does not define a document called a compliance statement. The closest official equivalent is a privacy notice, which the ICO says may also be called privacy information or a privacy policy. It should explain:

Why you are processing people's personal data.
How long you will keep it.
Who you will share it with.

A simple example line might read:

We use your email address to send the order updates you ask for,
keep it while your account is open, and share it only with our
delivery partner.

The ICO stresses that everything in a privacy notice should be simple to read and easy for people to access. It presents openness as a way to build trust, so people feel more confident about how their information is handled. On websites, it also says visitors should be told when cookies are in use and what each one does, and that cookies which are not strictly necessary need permission before they are set.

If you are a sole trader, start-up, small business or charity, the ICO offers a privacy notice generator that builds a tailored notice in a few guided steps, with versions for customer and supplier information and for staff and volunteer information. The ICO notes that this guidance is under review following the Data (Use and Access) Act, so check the page for changes. If your organisation is based in the EU, check the guidance from your own national data protection authority as well.

Sources

Frequently asked questions

Is an IP address personal data?

It can be. The ICO describes IP addresses and cookie identifiers as online identifiers that may be personal data, and Recital 30 of the GDPR explains that identifiers from devices and protocols can be combined with other information to identify people. If you can link an address to an individual, directly or with other information, treat it as personal data.

Does the GDPR apply to information about businesses?

Information about a company or public authority is not personal data in itself, because the law covers natural persons only. Information about sole traders, employees, partners or company directors can be personal data when it relates to them as individuals and they can be identified. Information about people who have died is not personal data under the ICO guidance.