What are the different types of personal data?

Personal data is any information that relates to an identifiable person. The ICO's guidance lists identifiers such as a name, an identification number, location data and an online identifier. Online identifiers include IP addresses and cookie identifiers, and the ICO notes that a social media handle or username can still identify someone.

It helps to sort personal data into a few groups.

Basic identifiers

The ICO's glossary of data types describes basic identifiers as information such as name, email address or address that can identify an individual. This is the data people-search sites and marketers collect first.

Online and location data

IP addresses, cookie IDs, usernames and location data don't always show a name, but they can single you out and are personal data when they relate to an identifiable person.

Special category data

The UK GDPR gives extra protection to special category data: personal data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data (when used to uniquely identify someone), health, sex life and sexual orientation. The ICO also says it covers data that reveals or concerns these details, not only data that states them outright. Processing it needs both a lawful basis under Article 6 and a separate condition under Article 9.

Why it matters to you

The type of data decides how much harm a leak can cause. A leaked username is an annoyance. A leaked home address, ID number or health record can lead to stalking, fraud or discrimination. Data protection law treats the last group more strictly for that reason.

A note on other classifications

Companies and security teams also use their own labels, such as public, internal and confidential. Those are internal policy categories, not legal ones, and the legal tests above come from data protection law.