When Non-Personal Data Becomes Personal: A GDPR Deep Dive

You cannot determine the Personally Identifiable Information classification of data (per GDPR) by looking at the data alone. In fact, non-PII data can become PII when provided to third parties which naturally has significant compliance consequences.