GDPR protects the personal data of an individual (data subject), namely any information that relates to an individual who can be directly or indirectly identified from that data. Pseudonymous data can be classed as personal data if it could be used to identify the data subject. Examples of personal data are names and email addresses, location information, ethnicity, gender, biometric data, religious beliefs, political opinions and health data. Health data is personal data that relates to the physical or mental health of a person and reveals information about their health status or which makes it possible to infer information about their state of health. Health data is classed as ‘sensitive data’ and, as such, it receives particularly stringent protection under GDPR.