HumenhukCIPP/US Study Guide
Chapter 14: The GDPR and International Privacy Issues

Personal Data and Sensitive Personal Data

Reviewed by Victor Humenhuk. Published . Reviewed .

Personal data is any data relating to an identified or identifiable natural person, directly or indirectly. Sensitive personal data is a special category needing explicit consent, and data is only anonymized if the process is irreversible.

How this supports CIPP/US study

Use this lesson to identify the disclosure, workplace or cross-border rule that changes the result in a fact pattern. Continue with the CIPP/US study plan.

Personal data is broadly defined as any data related to an identified or identifiable natural person, directly or indirectly. If pieces can be grouped to lead to identification, they constitute personal data. Deidentified, encrypted, or pseudonymized data remains personal data if it can be used to reidentify the person. Data is only Anonymized data if the process is irreversible.

IP address and cookie ID trap

Under the GDPR, an IP address and a cookie ID are examples of personal data - even though they are often not considered PII in the United States. Watch for stems contrasting EU and U.S. treatment.

  • Personal data examples: name, home address, email with a name, ID card number, location data, IP address, cookie ID, phone advertising ID, data held by a doctor even if separated from the patient's name
  • NOT personal data: a company registration number, generic role addresses like support@business.com, and anonymized data

Sensitive personal data is a special category receiving additional protection: race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, and sex life or sexual orientation. Unless an exception applies, processing it requires explicit consent for a specified purpose.

Key terms - quick answers

What is “Personal data”?
Any data relating to an identified or identifiable natural person, who can be identified directly or indirectly.
What is “Sensitive personal data”?
A special category of personal data (e.g., race, health, biometrics) that receives additional protection and generally requires explicit consent.
What is “Anonymized data”?
Data processed irreversibly so it can no longer identify a person; only then is it outside the definition of personal data.
What is “Pseudonymized data”?
Data that has been deidentified but remains personal data because it can still be used to reidentify the person.

Sources and study method

This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.