The GDPR applies to “personal data” which is any type of information that can be used to identify an individual. Examples are: e-mail addresses, buying habits, driver’s license numbers, bank account information, online account user names and passwords, employees’ information, medical and health information, etc.