GDPR - When does data become personal data, and what exactly comprises personal data?
<p>As a software developer, I am currently in the process of developing a small video analytics tool. I would like to take extra care regarding the GDPR, and have a hard time understanding the following:</p>
<p>Suppose I assign a user a randomly generated ID and store that ID in a database on my server and in a Cookie on the user's browser. This ID can be used to identify the user as &quot;that specific user&quot; (although I know nothing more about that user, just that the ID's match). Is this already personal data, or are any <strong>additional</strong> data points (videos that this user watched, in my case) considered personal data as the previously stored ID allows a clear assignment to a specific user (by ID)?</p>
<p><em>I am struggling to wrap my head around the idea that any data in combination with a unique identifier is supposed to be personal data, as in the example above, the user can be identified as a specific user, but arguably, no one could ever match that user to an actual, natural person?</em></p>
<p>For example, if I assign a visitor of a website an ID and additionally store his/her favourite colour, how is this even personal data?</p>

<p>From <a href="https://gdpr-info.eu/art-4-gdpr/" rel="nofollow noreferrer">Article 4 of the GDPR</a>:</p>
<blockquote>
<p>‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;</p>
</blockquote>
<p>The fact that you can use the ID in your database, along with the value returned by the cookie you set to identify the user makes it personal data.</p>
<p>The favorite colour is information relating to an individual.  The fact that it is connected to the cookie ID means that it is personal data.</p>

gdpr privacy data-protection consent