GDPR is much more inclusive than we’ve seen in other regulations. It covers direct and indirect data, and calls out specific data such as IP addresses as personal data.

http://www.computerweekly.com/opinion/GDPR-gotchas-and-how-to-handle-them