In our time, the use of virtual space has become inevitable. Legislation and protection of users' rights is also a necessity of virtual life. In the meantime, the definition of personal data as a standard for data subject to data protection laws has a great importance. As long as the data is not related to a specific person, it is as if privacy has not been violated and there is no need for protection. Now the question is, what data is considered personal? Can specific instances of personal data be specified? In response, it can be said that a case-by-case investigation must be done to determine personal data and cannot be satisfied with a general rule. Whether data is personal or anonymous varies depending on factors such as facilities, time, nature of data, cost of identification, technological developments and the purpose of data processing. In the case of definite cases, although there is no definite determination of a specific type of data as personal data; But some examples, such as surnames in addition to other identifiers and pseudonymous data, are highly possibility to be considered personal data in the legal systems of the European Union and the United States. In this article, the laws and judicial procedure of the European Union and the United States of America as effective and leading legal systems in the field of data protection have been examined in order to determine a standard for identifying personal data and its examples. keywords: Personal Data, Anonymous Data, General Data Protection Regulation (GDPR), Sensitive Data, Data Protection Laws 1. IntroductionIn the rapidly transitioning 'onlife' world, where technology integrates with all aspects of daily life, all phenomena are increasingly transformed into data. This data plays a critical role in power dynamics, enabling those who control it to influence markets, predict behavior, and potentially manipulate individuals. Given this reality, the preservation, management, and protection of data have become critical concerns, prompting the global enactment of data protection laws. These regulations naturally raise a fundamental question: What type of data should be protected?Across various legal systems, the key criterion for data protection is whether the data in question is classified as personal. Data not considered personal typically falls outside the scope of protection, exempting it from the legal rights and obligations associated with privacy laws. However, this distinction is not new. Early legal scholars, including Warren and Brandeis (1890), emphasized that privacy protections apply only to identifiable individuals. From this perspective, if data is not linked to a specific individual, privacy concerns do not arise, and thus, no legal protection is required.The accepted definition of personal data serves as the gateway to data protection law. Understanding this definition is essential for determining legal obligations and the extent of data protection measures. However, defining personal data is complex due to its multifaceted nature. These developments raise fundamental questions about the scope of personal data. Specifically, what level of connection must exist between information and an individual for it to be considered personal? Who must have access to the data for it to retain its classification? To what extent does data anonymization remove information from legal protection?A balanced definition of personal data is necessary. If it is too narrow, privacy protections become ineffective. Conversely, if defined too broadly, excessive compliance burdens may render enforcement impractical and disrupt normal digital activities. Scholars in Iran have recognized the importance of personal data (and have provided definitions. However, previous studies have largely neglected specific examples of personal data and how U.S. law classifies them. To address these gaps, this article examines criteria for distinguishing personal from anonymous data and identifies specific examples based on legal standards in the European Union and the United States. 2. MethodologyThis study employs a comparative legal approach, analyzing the definitions of personal data, the criteria for anonymization, and the legal treatment of sensitive data under the GDPR, the CCPA, and relevant case law.The research relies on laws, judicial decisions, regulatory guidelines, and academic literature. A qualitative methodology is applied, emphasizing legal interpretation, case analysis, and comparative evaluation.By identifying ambiguities and inconsistencies in defining personal data, this study aims to contribute to a clearer and more effective regulatory framework for data protection. The first section analyzes the definitions and key elements of personal data under EU and U.S. regulations. The second section explores definitive and controversial examples of personal data. The final section discusses sensitive personal data as a distinct category requiring special protection. 3. Results and DiscussionPersonal data is the cornerstone of data protection laws. Many legal systems define personal data flexibly, classifying any information that can directly or indirectly identify an individual as personal. However, defining personal data requires a contextual approach rather than rigid classifications. The classification of certain data types—such as IP addresses, pseudonymous data, and anonymized data—remains a subject of legal debate.A key observation is that the classification of data depends on contextual factors. Data that is personal under one set of circumstances may be considered anonymous under another. This makes it challenging to create exhaustive lists of personal data. Despite this, there is general consensus that certain data types, such as surnames combined with unique identifiers and pseudonymized data, are classified as personal data under EU and U.S. laws. In contrast, anonymized data and certain forms of metadata continue to spark legal controversy.Furthermore, personal data varies in sensitivity. Some categories require stricter protections due to the potential harm associated with their exposure. However, the classification of sensitive data is also subject to legal interpretation and depends on specific factual contexts. Within the Iranian legal system, forthcoming legislation should adopt a careful and nuanced approach to defining personal data. Given the rapid advancement of re-identification techniques, definitions should be broad enough to account for evolving technological capabilities. The GDPR and other leading frameworks emphasize expansive definitions to ensure robust data protection.Additionally, certain categories of information—such as court decisions and judicial opinions—necessitate regulated anonymization. A dedicated legal framework should be established to determine when data is truly anonymous. This framework should distinguish between anonymized and encrypted data, ensuring appropriate legal protections for each category. Clear guidelines will help service providers understand their obligations and reduce legal ambiguities. 4. Conclusions and Future ResearchThe definition of personal data is fundamental to data protection laws, yet it remains a flexible and evolving concept. Most legal frameworks classify any data capable of identifying an individual as personal, necessitating a contextual rather than rigid approach.While there is consensus on some identifiers, debates persist regarding elements such as IP addresses, metadata, and anonymized data. Certain personal data types require heightened protection due to their sensitivity, but their classification depends on legal interpretation and contextual analysis.For Iran, future data protection laws should adopt an analytical approach aligned with GDPR principles. Broad interpretations should be encouraged to address technological advancements. Additionally, clear anonymization guidelines should be established, particularly for public disclosures such as court rulings. A structured legal framework should differentiate anonymized data from encrypted data to prevent misinterpretation.Sensitive personal data necessitates stricter safeguards. Future legal frameworks should impose more rigorous processing regulations, moving beyond predefined lists to a more dynamic classification system. Future research should focus on methodologies for determining personal data based on evolving technologies and regulatory developments. Comparative studies across different jurisdictions could refine global best practices and provide clearer guidance for policymakers and organizations handling sensitive personal information.