GDPR protects a wide range of personal data, including but not limited to names, addresses, email addresses, social security numbers, IP addresses, and even cookie data. Essentially, any information that can identify an individual either directly or indirectly falls under GDPR.