# Personal data

Any information that relates to a living person who can be identified from it, directly or with other information, under UK GDPR and EU GDPR.

Source: https://sted.digital/docs/glossary/personal-data · Last reviewed 17 October 2026 · Strand Glossary

Personal data is any information that relates to a living person who can be identified from it, directly or once it is combined with other information. A name, a work email address, an IP address in a log and a customer number all count. Processing it is the first test of whether UK GDPR and EU GDPR apply to you.

## Where the term appears

EU GDPR Article 4(1) defines it, and the UK text keeps the same words as point (1) of UK GDPR Article 4(1), after the Data (Use and Access) Act 2025 renumbered the list of definitions as paragraph 1 on 5 February 2026. Data Protection Act 2018 section 3 gives the matching definition for the Act itself and limits it to living people in terms. The [GDPR overview](/docs/standards/gdpr) explains how the definition decides whether either law applies to you.

### Pseudonymised is not anonymous

This is the line auditors and regulators test. EU GDPR Recital 26 treats pseudonymised data, such as a dataset where names are swapped for codes and the key is kept elsewhere, as still personal data, because someone holding the key can identify people again. Truly anonymous data, where no one can identify a person by any means reasonably likely to be used, falls outside the law. Most "anonymised" exports are pseudonymised.

## How Sted uses it

Sted treats UK GDPR, and separately EU GDPR, as applying when you process any personal data and are established in that territory or offer goods or services to, or monitor, people there; it reads your controller and processor roles from your processing activities, notes when an Article 27 representative is needed, and holds its confidence at medium until a processing activity is recorded.
Onboarding asks about the personal data you process, activity by activity (its purpose, who it is about, how long it is kept and whether you act as controller or processor), and about transfers abroad with their safeguard; Summary's Data and privacy card lists the processing activities by name and status and each transfer's recipient, role and destination.
The card is a summary of what onboarding recorded, not a record of processing activities.

## Related terms

- [Special category data](/docs/glossary/special-category-data): the narrower kinds of personal data that need an extra condition.
- [Controller and processor](/docs/glossary/controller-and-processor): the two roles you can hold over personal data.
- [Lawful basis](/docs/glossary/lawful-basis): what every use of personal data needs.
- [Personal data breach](/docs/glossary/personal-data-breach): what happens when its security fails.
- [Records of processing activities (ROPA)](/docs/glossary/records-of-processing): your map of the personal data you hold.