The GDPR only applies to personal data. Personal data is any information relating to an identified or identifiable natural person (called a “data subject”). Examples include:
A name
An identification number
Location data
An online identifier
Factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person
Under the GDPR, all businesses should take measures to minimize the amount of personally identifiable information they store, and ensure that they do not store any information for longer than necessary.