The General Data Protection Regulation (GDPR) is an EU law on data protection and privacy, which also applies in the European Economic Area (EEA). Its obligations fall on whoever decides why and how personal data is used (the “controller”) and on anyone who processes personal data on a controller’s behalf (the “processor”). Controllers and processors can be companies, public authorities, non-profit organizations and, in some cases, individuals.

The GDPR protects people, whatever their nationality or place of residence. It does not protect information about companies themselves, such as a company’s name, legal form or contact details.

Applying to Companies and Other Organizations

The GDPR applies to processing of personal data in the context of an organization’s establishment in the EU, wherever the processing takes place. It also applies to processing by organizations outside the EU where the processing relates to offering goods or services to people in the EU, or to monitoring their behavior in the EU. An organization outside the EU is generally not covered just because people in the EU can visit its website.

There is no size threshold, although some specific obligations depend on the type of processing. For example, a data protection officer (DPO) must be appointed where processing is carried out by a public authority or body (except courts acting in their judicial capacity), or where an organization’s core activities involve regular and systematic monitoring of people on a large scale, or large-scale processing of special categories of data (such as health data) or data about criminal convictions.

Applying to Individuals

An individual can also be a controller. A freelancer, sole trader or other person who uses personal data for a professional or commercial purpose, such as keeping a client list, has GDPR obligations for that processing.

However, the GDPR does not apply to processing by a private individual in the course of a purely personal or household activity, with no connection to a professional or commercial activity. The GDPR’s recitals give examples such as personal correspondence, keeping addresses, and social networking and online activity carried out for such purposes. The GDPR still applies to the organizations that provide the means for that processing.

What Individuals Gain from the GDPR

As data subjects, individuals have rights over their personal data. These include the right to be informed, the right of access and the right to have inaccurate data corrected. Other rights apply only in certain circumstances: erasure on specific grounds, data portability where processing is based on consent or a contract and carried out by automated means, and the right to object, which applies without exception to direct marketing.

Organizations also need a lawful basis for each processing activity. Consent is one of six lawful bases under the GDPR; the others are contract, legal obligation, vital interests, public task and legitimate interests.

Conclusion

The GDPR’s obligations apply to controllers and processors: companies, public bodies, non-profit organizations, and individuals who process personal data for professional or commercial purposes. Private individuals acting in a purely personal or household capacity are exempt. The people whose personal data is processed benefit from the GDPR’s rights regardless of their nationality.

This article is general information, not legal advice.