Concepts and Definitions
The central legal definitions of Article 4 GDPR in detail: personal data, processing, pseudonymization, controller, processor, and further defined terms, with interpretation and delimitation.
Article 4 GDPR sets out up front the central concepts that the entire Regulation works with. Anyone applying a provision of the GDPR must first determine whether its statutory criteria are met, and those criteria are for the most part defined here. The following pages explain the individual legal definitions: their wording, their interpretation by the courts, and the distinctions that matter in practice.
1 The Data Concepts
What is subject to data protection law in the first place, and in what form data are processed.
- 1.2.1 Personal Data: the threshold that triggers all of data protection law: a natural and living person, identifiability, data relating to objects, synthetic data, and the distinction from anonymous data.
- 1.2.2 Processing: the broad catch-all concept for any handling of data, from collection to destruction.
- 1.2.3 Restriction of Processing: the marking of stored data to limit its future processing (formerly "blocking").
- 1.2.5 Pseudonymization: separating data from identity; the distinction from anonymization and encryption.
- 1.2.6 Filing System: a structured set that also covers manual files.
- 1.2.13 Genetic Data: data resulting from the analysis of a biological sample.
- 1.2.14 Biometric Data: data obtained through technical processing for unique identification.
- 1.2.15 Data Concerning Health: data on a person's physical or mental state of health.
2 The Actors
Who takes on which role within the data protection framework.
- 1.2.7 Controller: whoever determines the purposes and means; the primary addressee of the GDPR's obligations.
- 1.2.8 Processor: processing on behalf of a controller, with its own obligations and liability.
- 1.2.9 Recipient: any body to which data are disclosed.
- 1.2.10 Third Party: a body outside the controller's organization; there is no group privilege.
3 Operations, Rights, and Risks
Concepts relating to special processing operations and the self-determination of the data subject.
- 1.2.4 Profiling: the automated evaluation of personal aspects.
- 1.2.11 Consent: a freely given, informed indication of wishes serving as a legal basis.
- 1.2.12 Personal Data Breach: a breach of security that triggers the notification obligations.
About the author
About the author
This article was written by Dr. Thomas Helbing, specialist lawyer for IT law in Munich.
Since 2020 and continuously through today (2026), Handelsblatt has recognized Dr. Helbing as one of "Germany's Best Lawyers" in IT law and data protection law.
According to Kanzleimonitor.de (2024 to 2026 editions), he ranks among the leading lawyers for data protection and IT law and is listed among the top 100 lawyers in Germany (2024/25). Kanzleimonitor is considered a particularly meaningful market study because it is based exclusively on personal recommendations from in-house counsel.
Dr. Helbing has many years of advisory experience in data protection and IT law and advises clients of all sizes, from startups through fast-growing SaaS companies and unicorns to international corporate groups.
His professional background covers the full spectrum of IT and technology law practice. He began his career at a major international law firm, then gained in-house experience at a DAX-listed company, and is himself an entrepreneur and founder of several digital ventures. He also has hands-on programming experience, which allows him to understand technical systems, software architectures and digital business models not only from a legal perspective but also from a technical one.
For many years, his clients have included technology companies and SaaS providers, leading German research institutions and a systemically important German bank. His advisory focus lies in particular on GDPR compliance, the data economy, SaaS, AI regulation and IT contract law.
Statutory Text
The complete text of the GDPR and of the German Federal Data Protection Act (BDSG), subdivided into chapters, sections and individual provisions.
Personal Data (Article 4(1) GDPR)
Personal data as the threshold for the applicability of data protection law: relating to an identified or identifiable natural person, direct and indirect identifiability, data relating to objects and synthetic data, distinction from anonymous data.