Do NFC tags fall under data protection rules?
A blank tag holding an address is not personal data and creates no obligation. What does is the system it feeds: a record of who tapped what and when, or an identifier that can be linked to a person. The rules follow the record, not the object that triggered it.
The object is rarely the issue
A tag holding an address, a network credential or a piece of text about a product is not personal data and does not become so by being on a tag.
A tag can hold personal data, of course, and then it is personal data on an object anybody who handles it can read, which is a subject of its own.
Whether a given deployment falls under a given framework, which framework applies, and what the thresholds are depend entirely on jurisdiction and on the nature of the processing. The authority is national law and your own counsel rather than this page.
What can be said generally is where the risk sits, and it does not sit on the tag.
The record usually is
An identifier that can be connected to a person is generally treated as personal data, even when the identifier itself looks like a meaningless number.
So a badge identifier alongside a name, a per tag address alongside a session, or a tap log alongside an account are all records about people.
The identifier of a tag is exactly this kind of value. On its own it names an object; joined to anything about a person, it names the person.
Deployments get this wrong by reasoning about the tag rather than about the join, and the join is where the obligation appears.
The cases that catch people out
Attendance and access, where a record of who was where and when is created as a side effect of the system working at all.
Per tag addresses in a public deployment, which produce location data about visitors without anybody deciding to collect location.
Employee facing systems, where the balance of power changes what counts as consent and where the obligations are usually heavier.
And retention, which is the failure nobody notices: a system that keeps everything because deleting was never specified.
What to do about it
Decide what the deployment needs to record before it is built, and record that rather than everything the technology makes available.
Write down how long each record is kept and what deletes it, since a retention rule that exists only as an intention does not exist.
Treat per tag data as location data internally, which is the framing that produces sensible decisions without needing a legal opinion for each one.
And take advice for anything involving employees, access control, or a public deployment at scale, because those are the cases where the answer is jurisdiction specific and the cost of being wrong is real.
Frequently asked questions
Is a tag identifier personal data?
On its own it identifies an object. Joined to anything about a person it identifies the person, and that join is where obligations appear.
Does a tag on a poster create obligations?
Not the tag. The destination does, because that is where a visit is recorded.
Which framework applies to me?
That depends on jurisdiction and on what you process. National law and your own counsel are the authority, not a general guide.
What is the most common mistake?
Retention. Systems keep everything because deleting was never specified, and that is the failure nobody notices.