The test is whether that information can later be used to link to an individual. You might not have the information, but you might later be able to correlate it

The test is whether that information can later be used to link to an individual. You might not have the information, but you might later be able to correlate it against someone who does, and that makes it personally identifiable and under the scope of the GDPR. Here's a citation: "If you cannot directly identify an individual from that information, then you need to consider whether the individual is still identifiable. You should take into account the information you are processing together with all the means reasonably likely to be used by either you or any other person to identify that individual." https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/ https://ico.org.uk/for-organisations/guide-to-data-protectio...