Does GDPR Apply to Individuals?

The General Data Protection Regulation (GDPR) is a comprehensive data protection law enacted by the European Union to protect personal data and privacy. While it’s commonly associated with organisations and businesses, individuals may wonder: Does GDPR apply to me personally?

The answer depends on the context. GDPR primarily targets organisations, but in certain situations, it can also apply to individuals, mainly when they process personal data beyond purely personal or household activities.

When Does GDPR Not Apply to Individuals?

GDPR includes a “household exemption,” meaning it doesn’t apply when individuals process personal data strictly for personal or household purposes. This exemption is outlined in Recital 18 of the GDPR and further explained by the European Commission.

Examples where GDPR does not apply:

• Maintaining a personal address book;

• Taking photos at family events;

• Writing personal correspondence;

• Using social media for private, non-commercial purposes.

In these cases, since the data processing is for personal use without any professional or commercial connection, GDPR does not apply.

When Does GDPR Apply to Individuals?

GDPR can apply to individuals if they process personal data outside the scope of personal or household activities. This includes situations where individuals engage in professional, commercial, or public activities involving personal data.

Examples where GDPR may apply:

• Running a blog or website that collects user data (e.g., through contact forms or comments);

• Operating a home-based business that handles customer information;

• Using surveillance systems (like CCTV) that monitor public spaces;

• Managing a mailing list for a community group or event;

In such scenarios, individuals act as data controllers and are subject to GDPR obligations. 

Key Responsibilities If GDPR Applies

If you’re processing personal data in a context where GDPR applies, you have several responsibilities:

• Lawful Basis: Ensure there’s a legal basis for processing data (e.g., consent, contract).

• Transparency: Inform individuals about how their data is used and processed.

• Data Subject Rights: Respect the rights of individuals, including access, rectification, and erasure.

• Data Security: Implement appropriate security measures to protect personal data.

• Accountability: Maintain records of data processing activities and demonstrate compliance.

These responsibilities are detailed in Article 5 of the GDPR.

Common Misunderstanding: “I’m just one person, it doesn’t apply to me”

It’s a common misconception that GDPR only affects large organisations. However, GDPR focuses on the nature of data processing rather than the size of the entity. If you’re processing personal data in a way that impacts others’ privacy rights, GDPR may apply to you, regardless of whether you’re an individual or part of a larger organisation.