Art. 4 GDPR - Definitions

For the purposes of this Regulation:

1. ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
2. […]

What does that mean? 

When we think of personal data, we initially think of things like name, date of birth, email address or postal address. However, according to the GDPR, any data that allows conclusions to be drawn about a person is personal data. This therefore also includes identification data such as customer numbers, insurance numbers or tax numbers.

Source: Jan on Pixabay

In the broadest sense, you could even ask yourself whether a personal coffee mug in the office is a personalised date. The size of the cup or a saying printed on it could allow conclusions to be drawn about the identity of the person who owns it. Of course, this idea is very far-fetched, but it shows how far-reaching the idea behind the GDPR is.