Personal data definition: examples and what to remove from a document
The GDPR's personal data definition is broad: any information relating to an identified or identifiable natural person, directly or indirectly. A name is the most obvious example, but the definition goes much further: a phone number, an IP address, a license plate, a photograph or an employee ID are also personal data, as long as they make it possible to trace someone.
Article 4 of the regulation explains what an identifiable person is: one who can be identified, in particular by reference to an identifier (name, identification number, location data, online identifier) or to one or more factors specific to that person's physical, physiological, genetic, mental, economic, cultural or social identity. The text covers natural persons: information about a company is not personal data in itself, but the name of its manager or an employee's named email address is.
This broad definition has a direct consequence for anyone who handles documents: a contract, an invoice, meeting minutes or a tracking spreadsheet almost always contain personal data, often more than you would think at first glance. Identifying them is the first step before sharing, publishing or handing a file to an AI tool.
This article presents the definition and the categories set out by the GDPR, gives examples from real documents, then offers a checklist. The angle specific to AI assistants is covered on the page personal data and AI.
Definition and categories of personal data under the GDPR
The European Commission sums up the notion on its page what is personal data: a person can be identified directly, by their name for example, or indirectly, through a number, biometric data or a combination of several pieces of information. The GDPR then distinguishes three main categories, subject to increasingly strict rules as the risk to people grows.
| Category | Content | Rules |
|---|---|---|
| Ordinary data | Identity, contact details, professional life, financial data, login data, location | General GDPR rules (legal basis, minimisation, security) |
| Sensitive data (article 9) | Racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic, biometric and health data, sex life or sexual orientation | Prohibited in principle, save for a closed list of exceptions |
| Criminal data (article 10) | Convictions, offenses, security measures | Processing under the control of official authority or authorized by law |
In France, the national registration number (NIR), better known as the social security number, is subject to additional rules: its use is limited to specific purposes, mainly social security and healthcare.
The difference between personal data and sensitive data therefore lies in the content. All sensitive data are personal data, but only those listed in article 9 of the GDPR are called sensitive. A sick note mentioning a condition, a medical report or trade union membership mentioned in minutes therefore call for extra care, before any sharing as before any transfer to a service provider.
Examples of personal data in business documents
Personal data hide in ordinary documents, including those considered purely technical or financial. The table below gives examples, grouped by type.
| Type | Examples | Documents where they appear |
|---|---|---|
| Identity | Surname, first name, title, date and place of birth, nationality, photograph, signature | Contracts, résumés, identity documents, minutes |
| Contact details | Postal address, named email, phone number | Letters, invoices, customer records |
| Identifiers | Social security number, tax number, passport number, employee ID, case or contract number | Payslips, tax notices, HR files |
| Financial data | IBAN, salary, income, loan number | Statements, loan offers, final pay settlements |
| Technical data | IP address, login ID, license plate | IT logs, tickets, accident reports |
| Health data | Condition, treatment, sick leave, patient number | Reports, prescriptions, certificates |
Two families need particular attention. Indirect identifiers first: a case number or a unique role in a small company points to a person as surely as a name. Information about businesses next: a company's registration number is not personal data, but that of a sole trader is, since it designates a natural person.
Finally, opinions and assessments about a person (an annual review, an opinion in minutes, a remark in a comment) are also personal data relating to that person. A sentence such as "the manager of the Lyon site lacks rigor" targets a specific person, even without naming them, as long as the position has only one holder.
What to remove from a document before sharing it
Before passing a document to a third party, publishing it or giving it to an AI, run it through this checklist, in order:
- Direct identifiers: surnames, first names, signatures, photographs.
- Numbers: social security, tax number, IBAN, identity document, employee ID, case, contract, patient or claim numbers.
- Contact details: postal addresses, named emails, phone numbers.
- Sensitive data: health, opinions, trade union membership, and criminal data.
- Indirect identifiers: dates of birth, rare roles, precise places, dated events that allow cross-referencing.
- Hidden content: metadata (author, company), comments, tracked changes, file name.
Removing everything is not always desirable: a contract summary needs the dates and amounts. The data minimisation principle in article 5 of the GDPR calls for keeping only what serves the purpose of the transfer, and removing the rest.
Biffer, the software we publish, automates this search on your computer, offline: people, emails, phone numbers, addresses, dates, French company numbers (SIREN and SIRET), French social security numbers, IBANs, license plates and fields specific to 18 professions. You review the highlighted preview, untick false positives or add something missed, handled in all its occurrences, then choose to apply an alias, a mask, or keep the value. The boundary between these choices is explained in the article what is anonymization, the risks of sending files to an assistant in the article ChatGPT privacy, and the texts on the page regulations.
Find and remove the personal data in your documents
Biffer, published by Opcadia and designed by Romain Rissoan, trainer and consultant, runs on Mac and PC without sending your files anywhere. Free for 5 files per month with every feature, unlimited for €10 excl. VAT (€12 incl. VAT) per computer, paid once.
Frequently asked questions
What are the three types of personal data?
The GDPR distinguishes ordinary data (identity, contact details, professional life), the special categories known as sensitive data, listed in article 9 (health, opinions, origin, sexual orientation among others), and data relating to criminal convictions and offenses, governed by article 10.
What is the difference between personal data and sensitive data?
Sensitive data are a subset of personal data: those listed in article 9 of the GDPR, such as health or religious beliefs. Processing them is prohibited in principle, save for the exceptions in the text, whereas other personal data fall under the general rules.
Is a work email address personal data?
Yes, when it designates a person, such as firstname.lastname@company.com: it identifies its holder. A generic address, such as contact@ or info@, is not linked to a specific person and is not, in principle, personal data.
Your business documents anonymized, ready to be published or handed to an AI tool.
Biffer runs on your computer without sending a single file. Free for five files a month, unlimited for €10 excl. VAT per computer.
100% offline · Free: 5 files a month · No file sent