A user has supplied personal information in an anonymous form. What is this information&#39;s status under GDPR?
<p>I am implementing a user feedback function in an application for my employer. The feedback is anonymous, but users can enter any text in the form. </p>

<p>If a user includes personal information (e.g. their email) in the form, what is its status under the GDPR (and other similar regulations)? I am not actively cataloguing this information, but it can be used to easily identify a person. </p>

<p>The status of any PII (Personally Identifiable Information) is the same in GDPR regardless of location, or who enters it. Its goals are (among others) to stop any actor (company / government or other) from hiding responsibility about their use and practices around people's data.</p>

<p>GDPR does even apply to anything offline and on paper. </p>

<p>Basically it means you have to validate any entry field is free of PII before processing it. 
Or make it clear in your privacy statement how you handle this use-case.</p>

gdpr