What counts as personal data in a document? A line-by-line guide

Personal data in a document is any information about a living person who can be identified, directly or indirectly. That includes a name, but also an employee number or a job title only one person holds. Data about a company as such does not count.

This guide reflects EU law as of September 2026, with notes for the UK and the US.

What does the GDPR mean by personal data?

Article 4(1) of the GDPR covers any information relating to an identified or identifiable natural person. Natural person means a human being, not a company. Any information is wide: a salary, an appraisal, a comment about someone.

An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number ... (GDPR, Article 4(1))

Recital 26 counts all the means reasonably likely to be used to identify someone, by the data holder or by anyone else, given cost and time. The real question is not whether the name is there, but whether a reader could work out who this is.

What is the difference between direct and indirect identifiers?

A direct identifier points to one person on its own, like a full name. An indirect identifier needs a second piece of information: a register, a list, some context. The French regulator CNIL cites phone numbers, licence plates, social security numbers, addresses, voice and image. It also warns about combinations: a woman at a given address, born on a given day, in a given association.

Which data are special categories, and what about criminal data?

Article 9(1) sets a closed list. Processing data in these categories is prohibited unless an exception in Article 9(2) applies, such as explicit consent:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data used to uniquely identify a person
• Health data
• Sex life or sexual orientation

These data often appear by inference. Germany's data protection authorities (DSK, short paper No. 17, 2018) cite taking medication or regular visits to a particular church. Merely drinking alcohol is not health data; alcohol dependence is. In a document, think of a sick-leave date, a union fee on a payslip, a workplace adjustment for a disability.

Criminal offence data have their own rule. Article 10 covers criminal convictions, offences and related security measures. Processing is allowed only under official authority, or when EU or national law authorises it with appropriate safeguards. In the UK, the ICO says such data are not special category data, but similar rules and safeguards apply.

What is not personal data in a document?

The GDPR protects people, not companies. Recital 14 excludes data about legal persons, including their name, legal form and contact details. These items are usually outside the definition:

• A company name, legal form and registered office
• A company registration number (European Commission)
• A generic info mailbox (European Commission)
• A switchboard number (CNIL)
• Irreversibly anonymised data (European Commission)
• Data about deceased persons (Recital 27), though Member States may add rules

Watch the people inside the company. The Commission lists a named work email as personal data. The UK regulator ICO adds that data about sole traders, employees, partners and directors is personal data when they are identifiable. So a contract between two companies still names people: signatories, contacts, the project lead.

Truly anonymous data fall outside the GDPR (Recital 26). Pseudonymised data do not. Replacing Jane Example with [NAME1] is a form of pseudonymisation (Article 4(5)): whoever holds the key can link it back. In 2025, the Court of Justice confirmed that such data may not be personal for a recipient who truly cannot re-identify anyone (case C-413/23 P, on the rules for EU bodies). Do not assume that is you.

How do you read a real document line by line?

Take a fictitious HR letter from Example Logistics Ltd to an employee, Jane Example. For each line, ask: does it relate to a person, and could someone identify that person?

Only line 1 holds no personal data. Lines 4 and 7 carry special categories. Line 5 names nobody, yet points at one person. If you black out only the name before sending the letter to an adviser, the number, birth date, role and sick leave still give her away.

How do you check your own document before sharing it?

1. Decide who will read it and what they truly need.
2. Mark direct identifiers: names, signatures, named emails, photos.
3. Mark numbers: employee, social security, bank, phone, plate, file references.
4. Read for context: job titles, dates, places, rare facts.
5. Look for Article 9 and 10 content: health, union, religion, politics, sexuality, genetics, biometrics, offences.
6. Remember third parties: colleagues, witnesses, family.
7. Check hidden content: file properties, comments, tracked changes.
8. Keep the original safe and share only the masked copy.

Software can speed up steps 2 and 3, because names, emails, phone numbers, addresses, ID numbers and bank details follow patterns. ONYRI Sanitize, for example, detects them in the browser without uploading the file, and exports a flattened copy with nothing under the masks. It has no detector for medical terms in words, salaries as such or company names without a legal form. So lines 4 and 5 need a human eye: add those terms by hand and review the preview item by item before downloading.

Frequently asked questions

Sources & references