Personal data
Under GDPR, any information relating to an identified or identifiable natural person (data subject) — including direct identifiers (name, email) and indirect identifiers (device IDs, online identifiers, location data combined with other information). Properly anonymized data falls outside the personal-data regime; pseudonymized data typically remains personal data.
In practice
For a SaaS company, personal data includes obvious fields like name and email, plus less obvious ones — IP addresses, device identifiers, cookie IDs, and support-ticket free text that references an identifiable person. Any of these triggers GDPR obligations, including lawful basis and security of processing, the moment an EU resident's data is involved, regardless of where the company itself is based.
Common confusion
Engineers often assume hashing or truncating an identifier makes data anonymous and therefore out of scope. Pseudonymized data — a hashed email, a tokenized user ID — is still personal data under GDPR if it can be re-linked to a person using a key the organization or a processor holds. True anonymization requires that re-identification be impossible, not merely inconvenient.