GDPR introduces a new concept called "Personal Data" which includes things like IP addresses and opaque database keys. Something is personal data if it is tied

GDPR introduces a new concept called "Personal Data" which includes things like IP addresses and opaque database keys. Something is personal data if it is tied to an individual, regardless of whether sufficient information to identify that individual is contained in the data itself. An IP Address (or, according to some interpretations, an IP Address + timestamp but not an IP Address on its own) is Personal Data but not PII. The GDPR does not address PII at all. To a first approximation, PII is now an American legal concept and Europe has a completely different (and strictly broader) definition of privacy-relevant data.