Why Some EU VAT Numbers Belong to a Person, Not a Company

A VAT-registered sole trader is a taxable person and holds a VAT number the same way a company does. In some countries that number is built from the person’s national ID. Either way, if the holder is a natural person, the number is personal data. To see what a specific number returns, paste it into the free checker.

This is general information about how EU VAT numbers relate to personal data, not legal or tax advice. How the GDPR and national rules apply to your processing depends on your setup and the countries you operate in; confirm it with qualified counsel.

Can an individual have an EU VAT number?

Yes, if they are VAT-registered. Article 9(1) of the VAT Directive (2006/112/EC) defines a taxable person as ‘any person who, independently, carries out in any place any economic activity’. Legal form is not a criterion, so a natural person qualifies. Article 214 has member states identify taxable persons with an individual number, and Article 215 adds a country prefix (Greece may use EL). A sole trader who is VAT-registered has a number; depending on national small-business rules, some have none.

For B2B rules, legal form is irrelevant: a sole trader acting as a taxable person is treated like a company. A valid number is still a presumption, not a guarantee. Under Article 18(1) of Implementing Regulation (EU) 282/2011, unless the supplier has information to the contrary, it may treat a customer as a taxable person if the customer communicated a VAT number and the supplier obtained confirmation of its validity and of the name and address that go with it. Under Article 19, services received exclusively for private use count as received by a non-taxable person, unless the supplier can treat them as business use because the customer gave its VAT number and nothing points the other way, such as the nature of the services. What applies to a given transaction is a question for your tax adviser.

Which VAT numbers are built from a personal ID

The EU fixes only the prefix. The rest is national, and in some countries a sole trader’s national ID goes straight in.

Sweden. According to Skatteverket, the VAT number is SE, ten digits and 01. For an enskild firma (sole trader) the ten digits are the personnummer; for a company or association, the organisationsnummer. An organisationsnummer’s third digit is always at least 2, to avoid confusion with a personnummer, which starts with year and month so its third digit is 0 or 1. The last digit of a personnummer is a modulus-10 check digit (weights 1 and 2). Legal form cannot be read from an organisationsnummer. See validating Swedish VAT numbers in Node.js and the Sweden VAT API page.

Spain. According to the AEAT, the VAT number is ES plus the NIF. For natural persons the NIF is a DNI (eight digits and a control letter), a NIE (X, then Y or Z, seven digits and a letter), or a K, L or M form (K for Spaniards under 14 resident in Spain, L for Spaniards resident abroad, M for foreigners without an NIE). Legal persons and entities get a letter showing the legal form (for example A sociedad anónima, B sociedad limitada, G asociaciones, H comunidades de propietarios, P, Q and S public bodies, N foreign entities, W permanent establishments), seven digits and a control character. An autónomo’s NIF is their DNI or NIE. A Spanish business also needs an ROI registration (Registro de Operadores Intracomunitarios) for its NIF to work as an intra-EU VAT number in VIES, and not every autónomo has one. See Spanish VAT numbers in Node.js and the Spain VAT API page.

The Czech Republic. The DIČ is CZ plus a stem. For natural persons the stem is the rodné číslo (birth number). According to the GFŘ, the Czech tax administration, a natural person can since 1 January 2021 apply for an identifier assigned by the tax administrator instead, and it replaces the stem. So a Czech individual’s DIČ is often, not always, built on the rodné číslo.

The Netherlands went the other way. From 1 January 2020 a Dutch sole trader’s btw-id (NL, nine digits, B, two digits) no longer contains the BSN. The BSN-based omzetbelastingnummer is for dealings with the Belastingdienst only, and entering it instead of the btw-id is a common reason for a VIES ‘invalid’ result. See validating Dutch VAT numbers.

How to tell a person from a company by the number

Sweden and Spain let you guess from the string:

In other countries the number does not reliably show it, and the holder may still be a person:

• Poland. A sole trader’s VAT number is PL plus the NIP. Polish law (art. 3(2) of the act on registering and identifying taxpayers) says the NIP may not carry a meaning describing the taxpayer’s features. Natural persons who are neither VAT-registered nor in business use their PESEL as the tax identifier; a VAT-registered sole trader uses a NIP.
• Italy. A sole trader’s partita IVA is an 11-digit number, separate from their 16-character personal codice fiscale.
• France. An entrepreneur individuel gets a SIREN like a company; the VAT number is FR, a key and the SIREN.
• Germany. The USt-IdNr comes from the BZSt and is separate from the Steuernummer.
• Greece. The ΑΦΜ is nine digits, and there is no reliable way to tell individuals from entities.

Format describes how an identifier is built; it never proves VIES registration, and a ‘this is a person’ guess from format stays a guess. See format vs valid. Or run a number through the free checker.

What the API response tells you, and what it doesn’t

The endpoint is GET https://api.vatnode.dev/v1/vat/{vatId} with Authorization: Bearer <key>:

curl https://api.vatnode.dev/v1/vat/SE820115123401 \
  -H "Authorization: Bearer $VATNODE_API_KEY"

The response is trimmed and illustrative. The number is fictitious: it fails the national check digit, so it cannot be issued, and a real call with it would not come back valid. A successful check has this shape, trimmed to the identifier fields:

{
  "valid": true,
  "vatId": "SE820115123401",
  "countryCode": "SE",
  "registryCode": null,
  "registryCodeName": null,
  "taxId": null,
  "taxIdName": null
}

• There is no field for the type of holder. valid works the same regardless of legal form.
• Null identifier fields don’t mean nothing personal is there. For a Swedish number whose ten-digit block has a third digit of 0 or 1, registryCode, registryCodeName, taxId and taxIdName are all null. The same holds for a Czech suffix of 9 or 10 digits and a Bulgarian 10-digit suffix. vatId still carries the full number.
• Other numbers come back as they appear. For Spain taxId is the NIF exactly as it follows ES, person or entity, with taxIdName Número de Identificación Fiscal. ES87654321A (fictitious, fails the DNI letter) comes back, on a live result, with "valid": false and still "taxId": "87654321A", so a populated taxId does not mean the number is valid. Greek and Polish numbers work the same way. For an organisation-shaped Swedish number such as SE556123456801 (also fictitious, and it fails the check digit), registryCode and taxId are NNNNNN-NNNN, named organisationsnummer.
• Name and address can be personal. companyName and companyAddress can contain a person’s own name and address when the holder is a sole trader.
• Test keys won’t show it. A vat_test_ key accepts only XX fixture numbers and returns taxId: null, so the difference is visible only with a live key. The free plan includes live checks and needs no card. The field is covered in national tax ID inside an EU VAT number, and per-country behaviour in the coverage reference.

What changes when the holder is a person

When the holder is a natural person, the VAT number relates to an identified or identifiable individual, so it is personal data under Article 4(1) GDPR whatever its format. That includes a partita IVA, a SIREN-based French number and a Dutch btw-id that is not derived from the BSN. Where the holder is unknown, it may be personal data. A company’s VAT number is generally not.

Some sole traders’ numbers also contain a national identification number: a Swedish personnummer, a Spanish DNI or NIE, a Czech rodné číslo. Article 87 GDPR lets each member state set specific conditions for processing one, so the national rule applies on top of the GDPR. In Sweden, for example, Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning, 3 kap. 10 §, allows personnummer and samordningsnummer to be processed without consent only where clearly justified by the purpose, the importance of secure identification or another significant reason. That is not an EU-wide rule. A Greek ΑΦΜ or a Polish NIP is a tax number rather than a national ID number. Whether a country’s Article 87 rules reach it is a question for local counsel. Either way, an individual’s tax number identifies them, so it is personal data too.

Where an invoice has to show the customer’s VAT number, for example under reverse charge (Article 226(4) of the VAT Directive), keeping it on that invoice is generally a matter of legal obligation (Article 6(1)(c) GDPR). Not every invoice must carry it. Other uses of the same number, such as onboarding checks or monitoring, need their own basis, which is part of your own analysis.

None of the following is a specific legal requirement. They are common ways to apply data minimisation (Article 5(1)(c)), data protection by design (Article 25) and security of processing (Article 32):

• Keep the number with the customer or invoice record it belongs to. There is rarely a reason to copy it, or a personal ID parsed out of it, into separate columns, logs, analytics events, URLs, search indexes or support exports.
• Consider masking it in internal UIs where staff don’t need the full number.
• Invoice-bound numbers follow invoice retention. Numbers from checks that never led to an invoice (prospects, abandoned sign-ups, typos) have no invoice obligation and need their own, usually shorter, justification; the period is jurisdiction-specific, so confirm it with counsel.
• Where you can’t tell person from company, treat the record as potentially personal.

Retention and erasure are covered in storing VAT data under GDPR.

Common mistakes

• Assuming every sole trader has a VAT number, or that a valid number always means reverse charge.
• Reading person vs company from the string in countries that don’t encode it.
• Reading a null taxId as ‘nothing personal here’.
• Logging the whole API response, including companyName and companyAddress.

FAQ

Can a sole trader have an EU VAT number?

Yes, if the sole trader is VAT-registered. EU VAT law defines a taxable person by the economic activity carried out, not by legal form, so a natural person qualifies and is identified with an individual VAT number like a company. Depending on national small-business rules, some sole traders have no VAT number at all. This is general information, not tax advice.

Is an EU VAT number personal data under GDPR?

When the holder is a natural person, yes. The number relates to an identified or identifiable individual, so it is personal data under Article 4(1) GDPR whatever its format. A company’s VAT number is generally not personal data, and where you cannot tell who the holder is, it may be. This is general information, not legal advice.

Is a Swedish VAT number the same as a personnummer?

Not in general. A Swedish VAT number is SE, ten digits and 01. For a sole trader (enskild firma) the ten digits are the personnummer, so the VAT number contains it. For a company or association they are the organisationsnummer instead. Where the VAT number contains a personnummer, it is personal data and Swedish rules on national identification numbers apply on top of the GDPR. This is general information, not legal advice.

Is the Spanish NIF of a freelancer (autónomo) their DNI?

Yes. An autónomo’s NIF is their DNI, or their NIE if they are a foreigner, and the Spanish VAT number is ES followed by it. To use the number in intra-EU trade, a Spanish business also needs an ROI registration, and not every autónomo has one, so a correctly built number does not prove VIES registration.

Can I tell from a VAT number whether it belongs to a person or a company?

Sometimes, by format. Spanish numbers starting with a digit or K, L, M, X, Y, Z are natural persons, and a Swedish 10-digit block whose third digit is 0 or 1 has the shape of a personnummer or samordningsnummer. In Poland the law bars the NIP from carrying such a meaning; in Italy, France, Germany and Greece the number does not reliably show it. Format describes how the number is built, so a guess from format is only a guess.

Does the vatnode API say whether a VAT number belongs to a person?

No. The response has no field for the type of holder. valid works the same regardless of legal form, and companyName and companyAddress can contain a sole trader’s own name and address. A null taxId does not mean the response holds no personal number, because vatId carries the full number. You can see what a given number returns with a free key or the free checker.