I should've realized this earlier but I think I understand now the reason for the confusion. GDPR handles all kinds of data related to a person, so yes: a user

I should've realized this earlier but I think I understand now the reason for the confusion. GDPR handles all kinds of data related to a person, so yes: a username is personal data wrt GDPR personally identifiable information (PII) on the other hand is only a subset of data handled by the general data protection regulation (GDPR) This might clear that up https://techgdpr.com/blog/difference-between-pii-and-personal-data/ https://techgdpr.com/blog/difference-between-pii-and-persona...