The GDPR only applies to personal data. Personal data is any information relating to an
identified or identifiable natural person (“data subject”). Examples: a name, an
identification number, location data, an online identifier, or factors specific to the
physical, physiological, genetic, mental, economic, cultural or social identity of that
Under the GDPR, all businesses should take measures to minimize the amount of
personally identifiable information they store, and ensure that they do not store any
information for longer than necessary.