Personal data means any data that makes a living person identifiable. This could be ‘direct’, such as their name, or ‘indirect’. This is where combined information could identify the person. GDPR refers to special categories or sensitive data. This includes information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, details of health, sex life or sexual orientation, email addresses and IP addresses. It also includes genetic data or biometric data for the purpose of identifying someone.