Directly or Indirectly

GDPR covers both Person Data that 'directly' or 'indirectly' identifies a natural person.

Direct Person Data

While 'direct' identification is something like names, telephone numbers, many email addresses, etc.

Indirect Person Data

'Indirect' identification is something like ID number, IP addresses, etc. even the organisation storing these informations is not able to identify the person itself based on the information. As long as the piece of information will enable someone (else) to identify the natural person, then it is counted as 'person data'.

Exception

There is one exception, though, namely data required to run a technical system safely and securely. Therefore, IP numbers are excempted for web hotels and the like. But anyone else, not running the technical system, is not allowed to store the IP addresses. However, it does not mean that you are not allowed to use a web system that captures the IP address. You are just not allowed to store this information.





Oops

Your browser is not supported

A modern browser with Javascript ES6 is required

Any major browser from 2015 onwards will be suitable