It covers obvious identifiers such as name and email, and also information that could identify someone in combination with other data, including device identifiers and behavioural records. Business contact information is treated differently under some statutes.
Why it matters: the test is whether an individual could reasonably be identified, so data a business considers anonymous may still be regulated.