gdpr
Is the UUID considered personal data?
<p>I am planning to build a mobile platform which I would use the UUID as the username, and a password of user’s choice. So that users would just need to type a chosen password to use my services.</p>

<p>Beyond that, my intention is just to store in my 3rd party cloud service provider the country where the user resides. Any other information like name , picture , etc , would be stored in the user’s device. </p>

<p>Do I need to be GDPR complicant for this ? </p>

<h2>It depends.</h2>
<p>Can the data controller or another person, with &quot;means reasonably likely to be used,&quot; (see clause 26 of the preamble of the GDPR) use that data alone or in combination with other data to identify a natural person?</p>
<p>If yes, it is personal data within the meaning of the GDPR.</p>
<p>If no, it is not personal data within the meaning of the GDPR.</p>
<p>Anonymous data is not subject to the GDPR. &quot;The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.&quot;</p>
<p>Assigning an unique alphanumeric code to a thing does not necessarily make the code and/or the thing &quot;personal data&quot;. But if you have a set of data that is or can be linked by the unique alphanumeric code (e.g. as a primary key in a set of tables) and you can use it to identify a person, then it is personal data.</p>
<p>Either way, to be GDPR-compliant / to mitigate risk you should make some kind of record to reflect that process of thinking and what you decided. And if the answer is Yes, it is personal data, then you should record your &quot;lawful basis&quot; for processing the data and how you decided that.</p>

<h2><a href="https://gdpr-info.eu/art-4-gdpr/" rel="nofollow noreferrer">Yes</a></h2>

<blockquote>
  <p>‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, <strong>an identification number</strong>, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;</p>
</blockquote>
