Any data which can personally identify an individual – whether by itself or when combined with other pieces of information – is considered personal data. If that information has the potential to cause harm then it is considered a special category of personal data – things like bank details, sexual orientation, or political opinions, for example.