What Is “Personal Information”? How Privacy Laws Around the World Define the Concept That Drives Compliance
Every privacy law begins in the same place: a definition. Before any obligation to disclose, obtain consent, honor a deletion request, or report a breach attaches, the law must first establish what information it governs. That foundational concept, “personal information” in U.S. law and “personal data” in European and many international frameworks, is the threshold question that determines whether a law applies to a given dataset at all.
The definitions are not uniform. Across the privacy laws we track worldwide, the concept of personally identifiable information takes on meaningfully different shapes depending on jurisdiction, legislative philosophy, and enforcement context. For any business operating across borders, or even across multiple U.S. states, understanding those differences is not an academic exercise; it is a compliance prerequisite.
The United States: A Patchwork Without a Federal Anchor
The United States has no omnibus federal privacy law. Instead, the definition of personal information is scattered across a collection of sector-specific federal statutes and a growing patchwork of state comprehensive privacy laws. Each carries its own definitional scope, and the gaps between them are often where compliance risk lives.
HIPAA. Under the Health Insurance Portability and Accountability Act, the operative concept is “Protected Health Information” (PHI): individually identifiable health information created, received, maintained, or transmitted by a covered entity or business associate. The law identifies eighteen specific identifiers, including name, geographic data, dates, phone numbers, and biometric identifiers, whose presence makes health data PHI. HIPAA’s Safe Harbor and Expert Determination methods for deidentification are among the most developed in U.S. law. Our health information privacy and security practice covers the full scope of HIPAA obligations for covered entities and their vendors.
GLBA. The Gramm-Leach-Bliley Act governs “nonpublic personal information” (NPI) in the financial services context: personally identifiable financial information that a consumer provides to a financial institution, that results from any transaction with the consumer, or that the institution otherwise obtains. The definition is intentionally transaction-linked, and the GLBA compliance framework creates obligations around notice, opt-out, and safeguarding that apply regardless of whether comprehensive state privacy laws reach the same entity.
COPPA. The Children’s Online Privacy Protection Act broadly defines personal information collected from children under 13, including name, address, online contact information, screen names, telephone numbers, Social Security numbers, photographs and video, geolocation data, and any information that permits physical or online contact with a specific individual. As our analysis of children’s online privacy law makes clear, the practical scope of COPPA’s definition is even broader than its text, because the FTC has interpreted it expansively to capture device identifiers and persistent identifiers that track children over time.
California: The State That Set the Standard in the United States
The California Consumer Privacy Act (CCPA), and its amendment via the California Privacy Rights Act (CPRA), contains the most consequential state-law definition of personal information in the United States. The CCPA defines “personal information” as information that “identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”
The breadth of that language is intentional and significant. It captures not just names and contact details, but identifiers like IP addresses, cookie IDs, and device fingerprints; commercial information like purchase histories and browsing behavior; biometric data; internet or other electronic network activity; geolocation data; professional and employment information; and inferences drawn from any of the above to create a consumer profile. Household-level data is also covered, expanding beyond natural-person frameworks common in other jurisdictions.
The CPRA amended this definition in two important ways. First, it created a distinct category of “sensitive personal information,” including Social Security numbers, financial account credentials, precise geolocation, health information, racial or ethnic origin, religious beliefs, and sexual orientation or gender identity. Such sensitive personal information carries heightened obligations and a new opt-out right. California also subsequently expanded the sensitive information category to include citizenship and immigration status. Second, the CPRA codified the deidentification exclusion, removing from the definition of personal information data that has been deidentified in compliance with a four-part technical and operational standard.
California is also distinctive in another respect that is easy to overlook: the scope of the individuals it protects. When the CPRA’s amendments took full effect, California allowed the earlier temporary exemptions for business-to-business contact data and for employee and job-applicant data to sunset. As a result, the CCPA/CPRA now reaches personal information about individuals acting in a business or professional capacity, such as the contact information of an individual at a vendor, the counterparty’s negotiating team, a prospect captured in a CRM, as well as employees, applicants, and contractors. Almost every other U.S. state comprehensive privacy law takes the opposite approach, defining “consumer” to exclude individuals acting in a commercial or employment context, so that B2B and HR data fall outside their scope entirely. This makes California an outlier among the states and a trap for companies that assume their vendor databases and employee records are categorically exempt. Notably, the EU and UK GDPR have never drawn this line at all: because they protect any identified or identifiable natural person regardless of the capacity in which they act, business contact data and employee data have always been personal data in Europe. A multistate or global business therefore cannot assume that “business” data sits outside privacy law as the answer depends entirely on which framework applies.
Our CCPA/CPRA compliance practice regularly advises clients on where their data sits within these definitional boundaries, and the enforcement record from the CPPA makes clear that broad definitional scope translates directly into broad enforcement exposure.
The U.S. State Privacy Law Patchwork
Beyond California, more than 20 states have enacted comprehensive privacy laws, and while most follow a broadly similar model, their definitions of personal data diverge in meaningful ways.
Most state laws, including Virginia’s Consumer Data Protection Act (CDPA), Colorado’s Privacy Act, Connecticut’s CTDPA, and the laws enacted in Texas, Oregon, Montana, New Jersey, and elsewhere, define personal data as information that is linked or reasonably linkable to an identified or identifiable natural person, explicitly excluding de-identified data and publicly available information. This formulation is more circumscribed than California’s because it does not extend to household-level data and often uses a more bounded test for “reasonable linkability.”
The sensitive data categories in these laws largely track California’s, though with variations. Several states, for instance, treat biometric data as a standard sensitive category; others, like Illinois through its standalone Biometric Information Privacy Act (BIPA), govern it in a dedicated statute with a private right of action. The genetic privacy landscape adds another layer, with some states imposing restrictions on the collection and use of genetic data that go beyond what state comprehensive privacy laws require.
The definitional divergences matter for data mapping, because the same dataset may qualify as personal data under one state’s law but fall outside another’s scope. Understanding where the lines are, across all applicable jurisdictions, is the foundation of any defensible privacy compliance program.
The GDPR: Europe’s “Personal Data” Standard
The European Union’s General Data Protection Regulation (GDPR) defines “personal data” as any information relating to an identified or identifiable natural person. A person is identifiable if they can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to physical, physiological, genetic, mental, economic, cultural, or social identity.
Three features of the GDPR definition distinguish it from U.S. law. First, it does not extend to household-level data as it protects natural persons only. Second, its identifiability test is objective: Recital 26 requires taking into account all means “reasonably likely to be used” by the controller or any third party to identify the person, including cost and available technology. This forward-looking standard has led European data protection authorities to treat IP addresses, cookie identifiers, and device fingerprints as personal data even when processed in isolation from names. Third, the GDPR draws a hard line between pseudonymous data, which remains personal data because re-identification is technically possible, and truly anonymous data, which falls outside the regulation entirely.
The GDPR separately identifies “special categories” of sensitive data such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for unique identification, health data, and data concerning sex life or sexual orientation, that carry heightened restrictions and, in most cases, require explicit consent or another enumerated legal basis.
Our GDPR compliance practice advises U.S.-based businesses on territorial scope and compliance obligations, and our cross-border data transfer and Data Privacy Framework work addresses the mechanisms for lawfully moving personal data out of the EU.
The UK GDPR
Post-Brexit, the United Kingdom retained the GDPR framework through the UK GDPR, which it incorporated into domestic law via the Data Protection Act 2018. The definitional framework is substantively identical to the EU GDPR, with personal data meaning information relating to an identified or identifiable natural person and the same identifiability test anchored in Recital 26. Divergence between the two frameworks, through UK adequacy decisions, deregulatory amendments, and enforcement priorities, continues to evolve, but the foundational definition of personal data remains aligned for now.
Brazil: The LGPD
Brazil’s Lei Geral de Proteção de Dados Pessoais (LGPD), which came into full force in 2020, defines personal data as information regarding an identified or identifiable natural person. Like the GDPR, the LGPD identifies a category of sensitive personal data, including racial or ethnic origin, religious belief, political opinion, union or religious membership, health or sexual life data, and genetic or biometric data, and subjects it to heightened protection and limited legal bases for processing. Brazil’s data protection authority, the ANPD, has been expanding its enforcement footprint, making LGPD compliance increasingly operational for businesses with Brazilian users or employees.
Canada: PIPEDA and Its Successors
Canada’s federal privacy law for the private sector, the Personal Information Protection and Electronic Documents Act (PIPEDA), defines personal information broadly as information about an identifiable individual. Canadian courts and the Office of the Privacy Commissioner have interpreted “identifiable” to mean that there is a serious possibility that the individual could be identified through the use of information alone or in combination with other available information. Provinces including Quebec (through Law 25), Alberta, and British Columbia have their own private-sector privacy laws with similar scope. Quebec’s Law 25, which reached full effect in September 2023, introduced significant GDPR-influenced obligations including privacy impact assessments and data minimization requirements.
China: The PIPL
China’s Personal Information Protection Law (PIPL), effective November 2021, defines personal information as various kinds of information recorded electronically or otherwise related to identified or identifiable natural persons, expressly excluding anonymized information. The PIPL designates sensitive personal information as a distinct category requiring separate consent, encompassing biometric data, religious beliefs, designated medical conditions, financial accounts, individual location tracking, and personal information of minors under 14. The PIPL applies extraterritorially to processing of Chinese residents’ personal information outside China for certain purposes, making it a critical consideration for businesses serving Chinese users.
India: The DPDPA
India’s Digital Personal Data Protection Act (DPDPA), enacted in 2023 with implementing rules in development, defines personal data as data about or relating to an individual who is directly or indirectly identifiable from that data. The law draws a distinction between general personal data and a narrower category of processing that may carry heightened obligations, with the full contours of those distinctions to be specified through rules. India’s DPDPA is notable for including statutory duties on data principals (the individuals whose data is processed) in addition to obligations on data fiduciaries (the Indian law’s equivalent of controllers).
Australia: The Privacy Act
Australia’s Privacy Act 1988 defines personal information as information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not, and whether it is recorded in a material form or not. A significant reform package proposed by the Australian government would strengthen this framework, potentially introducing new definitions, expanding the right to erasure, and imposing direct regulation on entities that had previously been exempt due to their size.
The Cross-Cutting Themes
Across all of these frameworks, several analytical threads recur.
The identifiability spectrum. Every definition operates along a spectrum from directly identified to reasonably identifiable. The critical question in any jurisdiction is where on that spectrum the law draws the line and whether that line is set by reference to the controller’s own capabilities, the capabilities of any third party, or both. The GDPR’s objective, forward-looking test is the most demanding; U.S. state law approaches tend to be somewhat more permissive, though enforcement practice is pushing in a stricter direction.
Whose hands hold the data? A nuance that the broad statutory definitions tend to obscure is that the same dataset can be personal data in one party’s hands and not in another’s. This is the difference between absolute and relative identifiability, and it turns on who holds the re-identification key. The point was sharpened considerably by the Court of Justice of the European Union in EDPS v. SRB (Case C-413/23 P), delivered on September 4, 2025, which clarified how the GDPR applies to pseudonymized data. The dispute arose after a body resolving a Spanish bank transferred pseudonymized stakeholder comments to a consulting firm, where the comments were linked to natural persons only through a database that the transferring body alone could access. The Court rejected the view that pseudonymized data is invariably personal data even where the recipient cannot attribute it to a data subject, holding instead that classification depends on whether the recipient can reasonably reidentify individuals, taking into account technical, organizational, and legal factors. In other words, sufficiently strong pseudonymization can leave data personal for the original controller who holds the key, yet non-personal for a recipient who cannot reverse it and cannot identify the individuals by other means. The limit on that logic matters just as much: where the recipient does have means reasonably likely to enable identification, the data is personal in the hands of both parties.
This contextual approach does not collapse the distinction between pseudonymized and anonymized data, and it should not be overread. The EDPB’s draft Guidelines 01/2025 on pseudonymization continue to treat pseudonymized data as personal data wherever it can be linked back to an individual by the controller or any party with access to the additional information, and pseudonymization remains, in the GDPR framework, a safeguard and a factor supporting a legitimate interest analysis rather than an independent legal basis. The practical lesson for businesses is that identifiability must be assessed from a specific vantage point: who holds the keys, what auxiliary data each recipient can access, and what technical, organizational, and legal controls separate the two. Data that was never linked to an identifiable person in the first place (“inherently” non-identifying data) sits outside the regime entirely; data that has been de-identified or pseudonymized after the fact requires this holder-specific analysis to determine whether, and for whom, it remains in scope. The same questions recur under U.S. law, where the CCPA/CPRA’s reliance on contractual re-identification prohibitions is in part an attempt to address downstream-recipient risk that a purely relative theory of identifiability would leave unmanaged.
Deidentification, anonymization, and pseudonymization. Almost every framework creates an exclusion for data sufficiently stripped of identifying features, but the conditions for satisfying that exclusion vary significantly, and jurisdictions diverge most sharply on the legal treatment of the middle ground: pseudonymized data.
Under the GDPR, pseudonymized data remains personal data. Re-identification is technically possible, the “all means reasonably likely” test is objective, and pseudonymization earns credit only as a risk-reduction measure and a factor supporting a legitimate interest analysis, not as an independent legal basis. The UK GDPR follows the same approach.
Under the CCPA/CPRA, data falls outside the definition of personal information if it meets a four-part deidentification standard: technical safeguards preventing re-identification, business processes prohibiting re-identification attempts, access controls preventing inadvertent release, and contractual restrictions on downstream recipients. Pseudonymized data that could be re-identified with a key does not satisfy this standard and remains personal information.
South Korea’s Personal Information Protection Act (PIPA) presents a third model. PIPA defines personal information as information relating to a living individual that makes identification possible by name, registration number, image, or similar identifier, and it separately defines pseudonymized information as personal information processed so that a specific individual cannot be identified without the use of additional information. The critical feature is what pseudonymization does legally in that framework: it functions as an affirmative gateway to secondary use, not merely a risk-reduction measure. PIPA expressly permits use of pseudonymized data without consent for statistics, scientific research, and public interest recordkeeping, meaning pseudonymization itself is the legal authorization. That architecture has been extended further through the PIPC’s March 2026 revised Guidelines, which operationalize pseudonymization for AI development by recognizing model training as potentially qualifying as “scientific research,” and through a 2025 Supreme Court ruling holding that pseudonymization does not constitute “processing” for purposes of a data subject’s right to request suspension. As analyzed in a recent IAPP article on Korea’s emerging privacy governance model, legislative design, regulatory guidance, and judicial interpretation are converging to make pseudonymization a mechanism for enabling lawful AI data use with limited scope for data subjects to intervene, a substantially different legal architecture than either the EU or U.S. approach, and one worth watching as other jurisdictions wrestle with the same AI training data pressures.
The practical takeaway is that a business cannot apply a single deidentification or pseudonymization standard across its global operations. Data that is “deidentified” under U.S. state law may still be personal data under the GDPR; pseudonymized data that opens a lawful AI training pathway in Korea remains fully regulated in Europe. As discussed in our analysis of deidentified data under the CCPA/CPRA and the GDPR, the path to a credible deidentification claim is technical, operational, and contractual, not merely definitional, and the analysis must be run jurisdiction by jurisdiction.
Sensitive data categories. Every major privacy law identifies a subset of personal information that carries heightened obligations. The categories are broadly similar across frameworks but vary in specifics. Biometric data, for instance, is treated as sensitive under the GDPR, most U.S. state laws, and the PIPL, but is also governed in Illinois through a standalone statute with a private right of action that has generated enormous litigation. Our biometric privacy practice and genetic privacy practice address these categories in depth.
The household question. California is unusual in extending its definition to household-level data, a provision that has practical implications for smart home device manufacturers, connected appliance companies, and anyone whose products aggregate data about shared living spaces rather than discrete individuals.
Is “public” data personal information, and what counts as public? Nearly every framework carves out some version of “publicly available information” from its definition, but both halves of that exclusion, whether public data is in scope at all, and what makes data “public,” vary sharply by jurisdiction. The U.S. state comprehensive laws generally exclude publicly available information outright, yet they do not agree on what qualifies: California defines it to include information lawfully made available from government records as well as information a business has a reasonable basis to believe the consumer (or widely distributed media) has lawfully made available to the general public, and it expressly provides that biometric data collected without the consumer’s knowledge is not “publicly available.” Other states frame the carve-out more narrowly or more broadly, and some fold in data available from “widely distributed media” or data made available by the person without restricting it to a specific audience, a formulation that becomes contentious for social media posts shared to a limited circle. The GDPR, by contrast, contains no general “publicly available” exemption at all: information does not stop being personal data because it can be found in a public register or was posted online, which is why web-scraping of public profiles and the compilation of open-source data into dossiers remain squarely within the GDPR’s reach and have drawn significant enforcement attention. The practical consequence is that “it’s already public” is never a self-sufficient answer. Whether public data is personal information, and whether a given dataset is even “public” in the statutory sense, has to be assessed against the specific law that applies.
A Worked Example: The IP Address
No single data element illustrates these definitional principles better than the IP address, a string of numbers that, on its own, contains no name, yet sits at the center of how modern privacy law thinks about identifiability.
Across the major frameworks, the IP address is firmly within scope. The CCPA/CPRA expressly enumerates “Internet Protocol address” among the identifiers that constitute personal information. Colorado’s Privacy Act and the other Virginia-model state laws reach it through their “online identifier” language and their “linked or reasonably linkable” standard, and in practice the comprehensive state privacy laws treat IP addresses as personal data. Under the GDPR, the Court of Justice of the European Union held in Breyer v. Bundesrepublik Deutschland (Case C-582/14) that a dynamic IP address is personal data in the hands of a website operator where that operator has the legal means reasonably likely to be used to identify the visitor with additional information held by the visitor’s internet service provider. That holding is the IP-address expression of the identifiability principle developed above: the number is personal data not because it names anyone by itself, but because a specific party can bridge it to a named person using information another party holds, the classic holder-of-the-keys problem, with the ISP as key-holder.
The practical power of that bridge is easy to underestimate, and a recent Coin Center analysis of IP-based unmasking illustrates it starkly. The piece documents how litigants and the government routinely convert an IP address into a real-world identity by compelling the ISP to disclose the subscriber behind it, and it was the mechanism behind the Strike3 Holdings copyright-enforcement campaigns, in which the company monitors file-sharing networks, files “John Doe” suits, and subpoenas ISPs for the names and addresses tied to flagged IP addresses, and behind a Southern District of New York matter in which the government used publicly listed node IP addresses to establish venue. For a business, the lesson cuts in two directions. First, an IP address should be treated as personal information by default across the comprehensive regimes, with all the policy-disclosure, opt-out, and deletion obligations that follow. Second, the same episodes underscore why identifiability is probabilistic rather than certain: the subscriber on an ISP account is not necessarily the individual who performed a given act, and the Coin Center piece recounts an account holder sued over activity she denies, and a node mistakenly attributed to a roommate, which is precisely why the “reasonably likely” and “reasonably linkable” tests ask what a party can actually do with the data in context, not whether identification is guaranteed. The practical litigation pressure around IP addresses is already visible in California, where a wave of Song-Beverly and CIPA claims has targeted IP-address collection by websites.
Why the Definitions Matter for Your Business
The definition of personal information is not a background legal formality. It determines the scope of your privacy policy disclosures, whether you need data processing agreements with your vendors, what categories of data to include in your data mapping exercise, which data subject access requests you are obligated to honor, and what thresholds trigger breach notification obligations. For companies deploying AI systems, it also shapes what data can be used for training and inference under emerging AI governance frameworks.
Businesses operating across jurisdictions, whether U.S.-only companies navigating a patchwork of state laws or multinationals managing obligations under the GDPR, LGPD, PIPL, and beyond, cannot afford to apply a single definitional standard to their entire data inventory. The global privacy law landscape demands a jurisdiction-by-jurisdiction analysis, grounded in an accurate inventory of what data you hold, where it comes from, and where it goes.
RICHT’s global data protection practice and privacy compliance services help businesses build that foundation. Whether you need a privacy policy that accurately reflects your data practices across all applicable frameworks, a privacy impact assessment before a new product launch, or strategic counsel on cross-border data transfers, we are here to assist.
