§ 01
Definition
Article 4(1) GDPR gives a deliberately broad definition. Names and email addresses are obvious examples; online identifiers such as IP addresses, cookie IDs and device IDs can be too, as Recital 30 notes.
§ 02
How it works
Information counts as personal data if someone could reasonably identify the person, alone or combined with other data. The Court of Justice's Breyer ruling (2016) held that even a dynamic IP address can be personal data for a website operator that has legal means to identify the user via the ISP.
§ 03
Why it matters
This is why EU websites need a reason to log your IP, and why VPN providers' no-logs promises are also GDPR promises. Data that is truly anonymised falls outside the GDPR; pseudonymised data, such as hashed IPs, usually does not.