Skip to main content
Glossary termPublished inEU AI ActCRAeIDAS2

Personal data

What does "Personal data" mean under the EU AI Act, the Cyber Resilience Act and eIDAS 2?

Personal data as defined in Article 4, point (1), of Regulation (EU) 2016/679:

'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Defined in / by

Last updated: 22 August 2026.

Regulations

  • Cyber Resilience Act (CRA)

    The Cyber Resilience Act is Regulation (EU) 2024/2847. Its reporting obligations under Article 14 apply from 11 September 2026, to every product with digital elements on the Union market, including products placed there before the Regulation's main obligations start on 11 December 2027. Actively exploited vulnerabilities must be reported within 24 hours.

    Next
    Article 14 reporting obligations apply: actively exploited vulnerabilities and severe incidents

    Checked

  • EU Artificial Intelligence Act (EU AI Act)

    The EU AI Act is Regulation (EU) 2024/1689. On 2 August 2026 its transparency rules and enforcement machinery took effect, but the high-risk regime for credit scoring and life and health insurance pricing did not: Regulation (EU) 2026/1744 moved it to 2 December 2027. Prohibitions have applied since February 2025.

    Next
    New Art. 5 prohibitions; Art. 50(2) marking deadline for pre-existing generative systems

    Checked

  • electronic Identification, Authentication and Trust Services (eIDAS2)

    eIDAS2 is Regulation (EU) 2024/1183, which amends Regulation (EU) No 910/2014. It contains no calendar deadline: wallet availability runs 24 months from the entry into force of five implementing acts, and private relying-party acceptance 36 months. Those acts entered into force on 24 December 2024, giving end-2026 and end-2027.

    Next
    Member States to provide at least one wallet (Art. 5a(1))

    Checked