personal data
Any information relating to an identified or identifiable living person, whether directly or indirectly, from their name and phone number to their voice.
In plain terms
Personal data is like a footprint in the snow: it is not you, but it leads to you. This includes your name, address, email address, license plate number, your face in a photo, your voice in a recording, and even what you asked a chatbot last night if it can be linked to you.
The concept is important because it determines whether data protection rules apply to a piece of data. If data is personal, a company or authority cannot do whatever it wants with it: a legal basis is required, it must state how it will be used, and you have a say.
In the AI era, the circle has expanded. A language model's training data, a customer service conversation, or correspondence read by an AI agent can contain vast amounts of personal data, and this also includes what the system infers about you, such as your health status from your purchases.
Data is not personal because it is secret or embarrassing. Your publicly available name and workplace are also personal data, just known by many people.
How it works
- The first question is always whether the data relates to a living person and whether anyone can be identified from it. It is enough if the data identifies someone when combined with other data: a postal code, a date of birth, and a gender together often point to a single individual.
- If yes, the organization handling the data needs a legal basis, such as your consent, performance of a contract, a legal obligation, or the organization's legitimate interest. The latter is often used as the basis for training AI models.
- The organization may use the data only for the specified purpose, in the necessary quantity and for the necessary duration, and must ensure its security.
- You have rights: you can ask what is stored about you, request corrections or deletion, and object to certain uses.
- Stricter rules apply to particularly sensitive data (health, religion, political opinion, sexual orientation, biometric data used for identification). In case of violation, the authority, in Hungary the NAIH, can impose a fine.
An everyday example
You paste a colleague's email into an AI chatbot to help write a polite reply. The email contains the colleague's name, phone number, and the fact that they were on sick leave. You have thus shared personal, even health-related data with an external provider, although you only asked for drafting assistance.
Who is affected
A common misconception
Limits and risks
- The boundary is not sharp: whether a piece of data identifies someone depends on the circumstances and available technology, and AI can link more and more data fragments.
- What you once entered into an AI service is difficult to retract, and deleting a single datum from an already trained model is technically difficult to achieve.
- Data protection rules protect people's data. Different rules apply to data concerning companies as legal entities or trade secrets, but the name of a company manager or administrator is personal data.
- The concept varies by country: 'PII' used in American practice is generally narrower than EU personal data, so a foreign provider's promise may mean something different from what you expect.
Similar, but not the same
- special-category (sensitive) data – This is a more strictly protected subgroup of personal data. It includes, for example, health and religious data, as well as biometric data used for identification.
- anonim adat – Anonymous data can no longer be used to identify anyone by any reasonably available means, so data protection rules do not apply to it.
- trade secret – A trade secret protects the company's interest, while personal data protection safeguards the individual to whom the data relates.
Related concepts
data protection, adat, privacy
special-category data, biometrikus adat, health data, pseudonymized data
A brief history
The Council of Europe opened the first binding international treaty on the protection of personal data (Convention 108) for signature in 1981. The EU definition currently in use was established by the General Data Protection Regulation (GDPR), adopted in 2016 and applicable since 25 May 2018.
Where things stand
The concept is a long-established cornerstone of EU and Hungarian law. By the end of 2026, major debates focus on how it applies to training language models and data processing by autonomous agents. There is also debate over whether pseudonymized data is personal data for someone who cannot reverse-engineer it. In September 2025, in the SRB case, the Court of Justice of the European Union ruled that this may depend on the recipient's situation. In November 2025, the European Commission proposed clarifying the definition in this direction within the digital omnibus package.
In the news
- Hungarian article warns of GDPR risk when property managers upload condominium documents to AI toolsOct 27, 2026 · Jog
- Noyb comments on EU Council agreement on AI personal data processing under GDPROct 26, 2026 · Jog
- UK GDPR still applies to AI after the Data (Use and Access) Act, NeuralTrust saysOct 22, 2026 · Jog
- EU backs GDPR change letting AI use personal data without consentOct 19, 2026 · Jog
- LinkedIn: scammers use verified profiles and AI to target job seekersSep 24, 2026 · Work & HR
- Digital Omnibus: EU member states split over AI and data transfer rulesSep 21, 2026 · Jog
- Romanian experts warn of data protection risks in using AI in the justice systemSep 16, 2026 · Jog
- Spanish data protection authority receives first data breach report linked to an AI agentSep 15, 2026 · Jog
Also known as
personal data · personal data · personal information · personal data · personal information · personally identifiable information · PII
Sources
This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.