One of the functions of a federation is to define attribute vocabularies. The UK Federation defines 4 core attributes that IdPs should aim to provide. SPs are encouraged not to require anything else though they are free to use additional attributes if they are available.
Three of these core attributes are essentially anonymous and so don't represent personal data. However one, eduPersonPrincipleName, isn't and does - the federation recommends that it should only be released if it's really required and only when appropriate legal protection is in place.