Any information relating to an identified or identifiable natural person, the central concept the GDPR protects.
Personal data is any information that relates to a living person who can be identified, directly or indirectly, for example by name, an identification number, location data, or an online identifier. The GDPR's protections apply whenever personal data is processed.
Special categories, such as health, biometric, or political data, receive stronger protection because misuse can cause greater harm.
Related frameworks
KaitoSec