The GDPR applies to ‘personal data’, which means any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.
There are additional rules in the GDPR for organisations processing special category data. This includes information about an individual’s health.
