Personal Data

What is personal data?

Personal data is the term the EU privacy law, the GDPR, uses for information about a person who can be identified. Article 4(1) defines it as "any information relating to an identified or identifiable natural person."

"Identifiable" is the important word. A name counts, but so does anything that can point to one person when combined with other details. The law gives examples such as an ID number, location data and online identifiers.

For a B2B software company, personal data shows up in many places:

• Work emails and phone numbers of contacts at your customers.
• Your users' login names, IP addresses and cookie IDs. Recital 30 names IP addresses and cookie identifiers as online identifiers.
• Records about your own employees and job applicants.
• Support tickets, call recordings and chat messages that mention a person.

A business email like [email protected] is personal data, because it relates to Jane. A work address is still about a person.

The GDPR can reach a US company too. Under Article 3(2), it covers companies outside the EU that offer goods or services to people in the EU or track their behavior there.

What it looks like in a vendor's terms

A typical clause reads like this:

"Personal Data" means any information about an identified or identifiable person that Customer submits to the Service, as defined by applicable Data Protection Laws. Provider will process Personal Data only to provide the Service and as set out in the DPA.

• "That Customer submits to the Service": the promise may cover only what you upload, not data the vendor collects about your users on its own.
• "As defined by applicable Data Protection Laws": the meaning follows whichever laws apply, such as the GDPR or the CCPA.
• "Only to provide the Service": this limits what the vendor may do with the data. Look for exceptions elsewhere in the terms.
• "As set out in the DPA": the details live in the data processing agreement, not the main terms.

A real change we caught

Venpo flagged this change: Zoom now says it may sell business contact data. On September 17, 2026, Zoom limited its line "We do not sell your personal data" to data covered by its main privacy statement, and added that sales of business contact data may happen through Zoom Common Room. Business contact details, such as a name and a work email, are still personal data. A change like this can affect people at your company and at your customers.

Why it matters to you

Most privacy duties attach to personal data. If you decide why and how it is used, you are the data controller. Article 28 says you may only use processors that give sufficient guarantees to protect it.

Your own customers will ask, too. Customer DPAs and security questionnaires may ask which vendors receive personal data and what they may do with it. If a vendor widens its use of that data, your answers can go out of date without you noticing.

What to check

• How the vendor's terms define personal data, and whether the definition covers only what you upload.
• Whether the privacy policy describes uses beyond running the service, such as ads, analytics or AI training.
• Whether a DPA applies automatically or must be signed.
• Which subprocessors receive personal data, and in which countries.
• Whether the vendor treats business contact data differently from other personal data.

Personal Information

Personal information is the term used by California's privacy law, the CCPA. The statute covers information that "is reasonably capable of being associated with" a consumer or household.

It is close to GDPR personal data, with a few differences:

• It covers households, not only individuals.
• It excludes publicly available information, deidentified information and aggregate consumer information.
• A "consumer" is any California resident, not only a shopper.

That last point matters for B2B companies. The California Attorney General notes that the exemptions for employee data and business-to-business data expired on December 31, 2022. So the work email of a buyer in California is personal information too.

When a vendor's privacy policy has a California section, "personal information" there carries the CCPA meaning. For a side-by-side view of the two laws, see GDPR vs CCPA.

Data Subject

Read the full page on Data Subject

A data subject is the person the personal data is about. The GDPR's Article 4(1) gives that name to the identified or identifiable person.

In your business, data subjects include your users, the employees of your customers, your own staff and anyone who fills in a form on your site. Your vendors hold data about all of them.

Data subjects have rights. They can ask to see their data under Article 15 and ask for it to be erased under Article 17. Those requests usually come to you, the company they know, even when the data sits with a vendor. See data subject access request.

Article 28 requires a processor to help the controller answer these requests. Check that your vendor's DPA still says so, because this promise can change. For an example, see Klaviyo no longer promises to pass privacy requests on to you.

How Venpo helps

Venpo watches your vendors' privacy policies, terms and DPAs and emails you a plain-English alert when the way they describe or use personal data changes. The Fine Print Scan also shows whether each vendor sells data or uses it for ads.