Fundamentals

Personal Data Inferences: What They Are and Why They Matter

By Daniel Sardá · Published on October 21, 2026

7 min read1,352 words

An inference turns traces and earlier data into an attribution about a person. Understanding how it is made helps distinguish it from a fact, a profile, or a decision.

A platform records that someone frequently looks at camera reviews and, from that behavior, estimates that they intend to buy one. The person never stated that intention. Yet the system has produced new information about them: an inference.

Personal data inferences are conclusions, estimates, or predictions created from other data and attributed to an identified or identifiable person. They can help sort content, anticipate preferences, or assess an application. They are not necessarily true, sensitive, or unlawful. Their importance lies elsewhere: they can affect how an organization treats someone, even when that person does not know the attribution exists.

Key idea: An inference does not need to have been stated by a person to become personal information; what matters is whether it can be linked to them.

How an inference is made

The process often begins with relatively simple data. A service records visits, searches, or purchases; compares those traces with certain patterns; and produces a likely conclusion. The chain can be represented as follows:

input data → analysis → inference → possible profile → possible decision

Each step serves a different function. If someone repeatedly looks at photography products, that history is the observed data. The estimate, “they intend to buy a camera,” is the inference. Adding them to a category such as “potential photography customer” may form part of a profile. Showing them an offer, changing the order of a page, or subjecting an application to additional review is a subsequent action or decision.

This distinction avoids two mistakes. The first is calling every processed datum an inference. The second is assuming that every inference automatically produces a decision. Some merely help personalize an interface; others do play a role in significant opportunities.

Four ways of obtaining information about someone

A simple taxonomy helps identify what analysis adds. These categories are pedagogical and may vary across legal frameworks:

• Provided data: information supplied by the person, such as an email address or a preference selected in a form.
• Observed data: information recorded from their behavior, such as pages visited or frequency of use.
• Derived data: information resulting from a direct operation on other data, such as calculating monthly spending from recorded purchases.
• Inferred data: information that expresses a conclusion or probability about a characteristic, intention, or future behavior.

The difference does not depend only on the technique used. Calculating a sum and estimating a preference are both analytical operations, but the latter adds a proposition that was not explicitly present in the original data.

The source alone also does not determine whether information deserves protection. The European Union’s General Data Protection Regulation defines personal data by its relation to an identified or identifiable person, not by whether it was supplied directly. Other regimes take comparable approaches: California’s official CCPA guidance, for example, includes certain inferences used to create profiles. The precise scope always depends on the jurisdiction and the case.

An estimate is not a verified fact

Every inference involves some degree of uncertainty. “They are probably looking for a camera” is not the same as “they bought a camera.” Even a technically well-calculated estimate may describe a person poorly: perhaps they were researching a gift or helping a friend.

That does not make every inference useless. Recommendations can reduce friction and make a service more relevant. But it does require that they be presented and used according to their nature. A probability should not, for an institution’s convenience, become a certainty about someone’s identity, preferences, or intentions.

It is useful to separate three questions:

1. Is the inference accurate or reasonable? This concerns the quality of the data, the method, and the uncertainty.
2. May it be used for that purpose? This concerns the applicable rules, legitimate expectations, and proportionality.
3. What effect does it have? This concerns whether it merely sorts content or limits a meaningful option.

An accurate inference is not automatically lawful. And an incorrect inference does not cease to matter if it determines how the person is treated.

Useful distinction: Accuracy, legitimacy, and effect are different issues. Resolving one does not necessarily resolve the other two.

When a conclusion about a group becomes personal

Not every statistical pattern is personal data. Saying that “30 percent of users in an area prefer afternoon deliveries” describes a group and, in principle, does not attribute that preference to an individual. Saying that “Ana is estimated to prefer afternoon deliveries” does create a conclusion about a particular person.

The boundary depends on the reasonable possibility of identifying, singling out, or re-linking the information to someone. Removing names is not always enough. A supposedly aggregated dataset may retain combinations that distinguish individuals, while a genuinely anonymous statistic falls outside that personal relationship.

The UK data protection authority’s guidance on anonymisation underscores this contextual character: correlations and predictions can produce new information, and that information can be personal when it relates to an identifiable person.

Inference, profiling, and decisions are not synonyms

Profiling organizes or evaluates aspects of a person through automated processing. It may bring many observations and inferences together in an operational representation: likely interests, patterns of use, or a propensity to take a particular action.

An automated decision, by contrast, is an outcome or action based on automated processing. It may draw on a profile, but it may also rest on a simple rule; and a profile may exist without triggering a significant decision.

In the European framework, Articles 4 and 22 of the GDPR and the guidelines endorsed by the European Data Protection Board distinguish these concepts. Specific safeguards against solely automated decisions apply in defined circumstances, particularly where there are legal effects or similarly significant effects. They do not create a universal right to know all the code in any system.

This precision matters because the appropriate control depends on the stage. Correcting an input datum, challenging an inference, and requesting review of a decision are related actions, but they are not interchangeable.

What controls make them open to challenge

When an inference affects meaningful options, autonomy requires more than passively accepting the classification. Control does not mean prohibiting data analysis or requiring the publication of trade secrets. It means that a person can understand enough to detect errors, contest attributions, and know the consequences.

A reasonable framework should allow someone to ask:

• what categories of data fed the inference;
• the purpose for which it was created and used;
• whether it expresses a fact, an estimate, or a score;
• its degree of uncertainty and how long it is retained;
• whether it produces a significant decision and how that decision can be reviewed.

In the European Union, rights of access and rectification exist alongside specific safeguards for certain solely automated decisions. Their application has limits and exceptions. When it is required, human review provides genuine control only if the reviewer understands the result, considers additional information, and can change it; a mechanical confirmation does not alter the substance of the process.

These controls are part of a wider discussion about control over personal data and about protecting personal autonomy when organizations have a great capacity to classify people. For practical recommendations, AI and personal data also raises specific implementation issues.

Principle of control: The greater an inference’s effect on a person’s opportunities, the more important transparency, the ability to challenge it, and effective review become.

The decisive point is not to prevent every prediction

Making inferences is common and, in many contexts, useful. The problem arises when an uncertain conclusion gains authority without the person knowing its origin, purpose, or how to challenge it.

An open society need not choose between innovation and individual liberty. It can permit legitimate uses of analysis while also requiring proportionate limits where classifications alter opportunities. The practical question is not only what data an organization holds, but what it believes it knows about each person, on what basis, and for what purpose.