Make your website GDPR compliant today — Cookiebot automates cookie consent, scanning, and compliance so you don't have to.
Try Cookiebot Free
Article 2
Material scope
Chapter 1|General Provisions|📖 3 min read
1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.
2. This Regulation does not apply to the processing of personal data:
(a) in the course of an activity which falls outside the scope of Union law;
(b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU;
(c) by a natural person in the course of a purely personal or household activity;
(d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.
3. For the processing of personal data by the Union institutions, bodies, offices and agencies, Regulation (EC) No 45/2001 applies. Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with Article 98.
4. This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive.
Understanding This Article
Article 2 defines which types of data processing activities fall under GDPR's jurisdiction, establishing both what is covered and what is explicitly excluded from the regulation's scope.
Paragraph 1 establishes broad applicability: the GDPR covers both automated processing (using computers or electronic systems) and manual processing if the data is part of a structured filing system. This ensures technology-neutral coverage - the regulation applies whether you're using advanced AI systems or paper files, as long as the data is organized in a way that makes specific information readily accessible.
Paragraph 2 sets out four key exclusions. Item (a) excludes activities outside EU law's scope entirely. Item (b) excludes processing by member states for common foreign and security policy purposes. Item (c) provides the 'household exemption' for purely personal activities like keeping a personal address book or posting on social media for friends and family. Item (d) excludes law enforcement and criminal justice processing, which is instead governed by separate legislation (the Law Enforcement Directive).
Paragraph 3 clarifies that EU institutions have their own data protection regulation (now replaced by Regulation 2018/1725), though it aligns with GDPR principles.
Paragraph 4 ensures the GDPR doesn't conflict with the E-Commerce Directive, particularly regarding intermediary liability.
Key Points
Applies to both automated and manual processing of personal data that forms part of a filing system
Technology-neutral: covers all forms of data processing regardless of the technology used
Excludes purely personal or household activities (e.g., personal address books, social networking for personal use)
Does not apply to processing for criminal law enforcement purposes or national security activities
Excludes activities outside the scope of EU law and certain government activities under TEU provisions
Practical Application
Automated Processing Example: Any company using CRM software, email marketing platforms, or website analytics falls under GDPR because these involve automated processing of personal data. An online retailer processing customer orders through an e-commerce platform must comply with all GDPR requirements.
Manual Filing System Example: A doctor's office maintaining patient files in paper folders organized alphabetically must comply with GDPR. However, a random collection of unorganized papers would not constitute a 'filing system' and may not be covered.
Household Exemption Example: Keeping contacts in your personal phone or sharing family photos on your private social media account is exempt. However, if you're running a business page or publishing content accessible to the general public, the exemption doesn't apply.
Law Enforcement Exemption Example: When police process personal data while investigating a crime, GDPR doesn't apply - instead, the Law Enforcement Directive (Directive 2016/680) governs that processing. However, if the same police department processes employee HR data, GDPR applies to that activity.
Borderline Case: A neighborhood watch group's activities might qualify for the household exemption if truly personal and informal, but creating a formal database of local residents would likely fall under GDPR if it goes beyond purely personal activity.