When Does Data Stop Being Personal Data?

Few questions in data protection law carry as much practical weight as this one: when does data stop being personal data? The answer determines whether the GDPR applies at all and with it, whether individuals hold rights of access; whether data can be shared with third parties or transferred outside the EU without GDPR safeguards; and what is permissible in AI development. In short, the boundary between personal data and non-personal data is the watershed of data protection law.

The stakes are only rising. With AI, this boundary is becoming more important and harder to draw. A data that is genuinely anonymous today may simply not be tomorrow.

Personal Data or Not?

Under the GDPR, “personal data” means any information relating to an identified or identifiable person. A person is “identifiable” if they can be identified, directly or indirectly, for example, by reference to a name or an identification number. In practice, this is a broad concept: data does not need to carry a name or