Article 4 of the Applied GDPR sets out most of the definitions. Definitions in the Applied GDPR are, in some cases, supported by further explanation in the recitals of the Applied GDPR.  In addition, there are some definitions in the Implementing Regulations which apply only to specific Parts or Schedules of the Implementing Regulations. (see regulation 134 for example) 

The following are fundamental definitions in the legislation.  Most of the definitions are included in the Closer Look guide.


Personal data


any information relating to an identified or identifiable natural person ( 'data subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person

Find out more about 'personal data'

Article 4(1)Applied GDPR 

Special categories of personal data


racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation

Find out more about 'special categories of personal data'

Article 9 Applied GDPR



  any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Article 4(2) Applied GDPR




the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law

Find out more about controllers and processors

Article 4(7) Applied GDPR

Regulation 6 Implementing Regulations



a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller

Find out more about controllers and processors

Article 4(8) Applied GDPR



any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her

Find out more about consent

Article 4(11) Applied GDPR

Domestic purposes


processing of personal data by a natural person in the course of purely personal or household activity. 

'domestic purposes' do not include operating a business from your home or the installation or the use of CCTV which covers areas beyond the boundaries of your domestic property

Article 2(2)(c) Applied GDPR