Personal data is any information that relates to a living person who can be identified from it, either on its own or combined with other information. That is the definition UK GDPR uses, and it is wider than PII (personally identifiable information), the American term marketers often borrow, which tends to mean only obvious identifiers such as names, email addresses and phone numbers.
How personal data works
The test is identifiability. A name and email address clearly qualify. So can information that does not name anyone: an online identifier such as a cookie ID, a device ID, an IP address, location data, or a combination of details like postcode, job title and employer that together point to one person. If you could reasonably single someone out, the data is personal.
Changing the format does not change the status. A hashed email address used to match customers in an ad platform is pseudonymised, not anonymous, because the platform can match it back to an account. Pseudonymised data is still personal data under UK GDPR. Only truly anonymised data, where nobody can reasonably re-identify the person, falls outside it.
Some categories carry extra protection. Special category data, such as health, ethnicity, religion or sexual orientation, needs an additional legal condition before you process it. A private clinic that builds an ad audience from people who booked a particular treatment is handling health information, whatever the spreadsheet column is called.
Why it matters
Every UK business that runs a website with a contact form, analytics or ad pixels processes personal data. That brings duties: a lawful basis for each use, a clear privacy notice, sensible retention, security, and the ability to respond when someone asks for their data. The ICO is the regulator, and most organisations processing personal data must also pay it the data protection fee.
Analytics tools add their own rules. Google’s Analytics terms forbid sending it information that Google could use to identify a person, such as names, email addresses or phone numbers. Breaking that rule can put the account at risk, and it is a data protection problem in its own right.
Common mistakes
- Personal data in URLs. A form that submits by GET, or a thank-you page with ?email= in the address, sends the email address to GA4 as part of the page location on every visit.
- Treating hashing as anonymisation. Hashed identifiers remain personal data and need the same lawful basis and transparency.
- Assuming B2B contacts are exempt. A named person’s work email address, such as jane.smith@company.co.uk, is personal data.
- Custom dimensions that capture identities. Sending a CRM customer ID is usually fine; sending a name or email is not.
- A template privacy notice. It must describe what your site actually collects and who receives it.
How to act on it
Search your GA4 page path and query string report for @ signs, “email”, “name” or “phone”. If anything appears, fix the source: change forms to submit by POST, remove personal fields from redirect URLs, and use GA4’s data redaction settings for email addresses and chosen query parameters as a safety net. Then ask Google to delete the affected data using a data deletion request in GA4’s admin settings.
Next, map what personal data the site collects: forms, chat widgets, booking tools, pixels and analytics. For each, note why you collect it, the lawful basis, who receives it and how long you keep it. That list is the backbone of an honest privacy notice, and you can see how this site describes its own processing in its privacy policy.
If your tracking set-up passes personal data where it should not, fixing it is part of the measurement work I do within performance marketing. I am not a lawyer, so for anything involving special category data or a reported breach, take specialist legal advice.