Personal data is any data set that can uniquely identify an individual by itself without relying on other data.  So John Smith, New York is not personal data.  John Duncan-Smyth Abercrombie PhD almost certainly would be personal data if he existed.  Likewise an email address of misterbob@gmail.com is not personal data as we have no idea who that is unless we already know them, whereas linda.pagillo@microsoft.com might be personal data as there might only be one Linda Pagillo working at Microsoft.  My surname is quite rare so this would probably be the case if I worked there.

So you can see it’s not always easy to decide what personal data is.  But IP addresses without other knowledge are not personal data as from the IP alone you cannot say that is Linda Pagillo without having much more details.  Even in the case of a email address containing a full name where you could decipher who it was from the email address alone, you are still ok as you are acting as a processor, and the sender has “soft-opted in” by sending it to the recipient and through your servers to process it.

To minimize your risk and ensure your compliance click here