Personal data refers to any information relating to an identified or identifiable natural person. This covers everything from their name and address to any identification number you might assign, or any piece of information relating to their physical, physiological, genetic, mental, economic, cultural or social identity.
The GDPR widens the scope of personal data to include online identifiers like IP addresses, social networking profiles and the like, and it’s even possible that pseudonymised data could fall under the data protection banner if it can be attributed to a particular individual.
And that’s not all - certain types of personal data are sensitive. Under the GDPR, this is called ‘special categories of personal data’, and, while the categories are similar to those under the DPA, they specifically include genetic data.
There are few exceptions to the GDPR, but the law doesn’t apply to the processing of personal data by individuals for purely domestic or household functions, or to the processing of personal data for the purpose of national security.