GDPR Art. 2 EN

LLM context

Material scope

Material scope (GDPR)

In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗

Version history 2

2016-05-04in force CELEX 02016R0679-20160504
2016-04-27 CELEX 32016R0679

1.

This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.¶

Material scope (GDPR) Personal Data Processing 168
2.
This Regulation does not apply to the processing of personal data:¶

Personal Data Processing 92
1. a)
  in the course of an activity which falls outside the scope of Union law; ¶
  Material scope (GDPR)
2. b)
  by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; ¶
3. c)
  by a natural person in the course of a purely personal or household activity; ¶
  Material scope (GDPR)
4. d)
  by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. ¶
3.

For the processing of personal data by the Union institutions, bodies, offices and agencies, Regulation (EC) No 45/2001 applies. Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with Article 98.¶

Processing Personal Data 20
4.

This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive.¶

18

Enforcement

Cited in 77 fines totalling €6.5M

Top authority: 🇪🇺Italian Data Protection Authority (Garante) (70) · median fine €6,000 · see all enforcement for Art. 2 →

Connections by provision

2(1) 120 Case Law 24 Enforcement 22 Guidance 2 Literature .md

Case Law 120

Data Protection Commissioner v Facebook Ireland and Maximillian Schrems Meta Platforms and Others v Bundeskartellamt BGH: GDPR not exhaustive on injunctive relief; online store data transfer case remanded Art. 16 GDPR requires formal rectification request; vague tweet does not suffice HvJ EU 9 januari 2025, C‑394/23 (Mousse). LG Frankfurt am Main - 2-06 O 234/25 Cour Administrative - 49701C CJEU C-312/24 Darashev: Data subject's right to erasure of criminal investigation data +112 more

Enforcement 24

NAIH (Hungary) - NAIH-4462-5-2026 Icelandic DPA: City of Reykjavik cannot request bank statements from NPA disabled service Persónuvernd: Icelandic Farmers’ Association breached GDPR by disclosing owner data to HDPA investigates Greek Infrastructure Ministry for SMS sent without consent or Finnish DPA examines anti-doping organization's GDPR compliance over public suspension NAIH (Hungary) - NAIH-11443-3/2026 Garante per la protezione dei dati personali (Italy) - 462/2026 CNPD (Portugal) - Deliberação 2019/494 +16 more

Guidance 22

Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive EDPB-EDPS Joint Opinion 4/2026 on the Proposal for a Cybersecurity Act 2 and the Proposal on amendments to the NIS 2 Directive EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework ( EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision +14 more

Literature 2

Generative AI and data protection Perspectives for Open Source AI

2(2) 52 Case Law 3 Enforcement 36 Guidance 1 Literature .md

Case Law 52

Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums Meta Platforms Ireland Ltd, formerly Facebook Ireland Ltd v European Commission RK v Ministerstvo zdravotnictví Österreichische Datenschutzbehörde v WK Agentsia po vpisvaniyata v OL Finnish Supreme Administrative Court: cookie banner with harder "Reject All" violates VS v Inspektor v Inspektorata kam Visshia sadeben savet CJEU - C-205/21 - Ministerstvo na vatreshnite raboti +44 more

Enforcement 3

Garante per la protezione dei dati personali (Italy) - 487/2026 HDPA (Greece) - 32/2020 ¶70 Garante per la protezione dei dati personali (Italy) - 487/2026

Guidance 36

Guidelines 01/2022 on data subject rights - Right of access Statement 2/2025 on the implementation of the PNR Directive in light of CJEU Judgment C-817/19 EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility related applications Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation +28 more

Literature 1

Perspectives for Open Source AI

2(2)(a) 72 Case Law 2 Enforcement 6 Guidance .md

Case Law 72

Österreichische Datenschutzbehörde v WK CJEU - C‑313/23, C‑316/23 and C‑332/23 - Inspektorat kam Visshia sadeben savet VQ v Land Hessen Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums VS v Inspektor v Inspektorata kam Visshia sadeben savet Komisia za zashtita na lichnite danni and Tsentralna izbiratelna komisia v Koalitsia „Demokratichna Bulgaria - Obedinenie“ CJEU - C‑474/24 - NADA Austria and Others Cour Administrative - 49701C +64 more

Enforcement 2

Finnish DPA examines anti-doping organization's GDPR compliance over public suspension ¶2 Finnish DPA examines anti-doping organization's GDPR compliance over public suspension

Guidance 6

Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679 EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space ¶40 EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space ¶22 EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 ¶9 Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679

2(2)(b) 7 Case Law 6 Guidance .md

Case Law 7

VQ v Land Hessen Komisia za zashtita na lichnite danni and Tsentralna izbiratelna komisia v Koalitsia „Demokratichna Bulgaria - Obedinenie“ Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums ¶317 European Commission v Republic of Poland ¶71 VQ v Land Hessen ¶36 Komisia za zashtita na lichnite danni and Tsentralna izbiratelna komisia v Koalitsia „Demokratichna Bulgaria - Obedinenie“ ¶34 Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums

Guidance 6

Contribution of the EDPB to the European Commission’s evaluation of the Data Protection Law Enforcement Directive (‘‘LED’’) under Article 62 LED EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space ¶151 EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 ¶41 EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space ¶70 Contribution of the EDPB to the European Commission’s evaluation of the Data Protection Law Enforcement Directive (‘‘LED’’) under Article 62 LED

2(2)(c) 5 Case Law 21 Guidance .md

Case Law 5

European Commission v Hungary MK v WB ¶15 MK v WB ¶23 MK v WB ¶357 European Commission v Hungary

Guidance 21

Guidelines 3/2025 on the interplay between the DSA and the GDPR Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679 Guidelines 8/2020 on the targeting of social media users Opinion 7/2024 on the draft decision of the German North Rhine Westphalia Supervisory Authority regarding the EU Cloud Service Data Protection (Auditor) certification criteria EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications Guidelines 01/2022 on data subject rights - Right of access +13 more

2(2)(d) 31 Case Law 3 Enforcement 2 Guidance .md

Case Law 31

Criminal proceedings against V.S VS v Inspektor v Inspektorata kam Visshia sadeben savet Ligue des droits humains ASBL v Conseil des ministres SIA 'SS' v Valsts ieņēmumu dienests CJEU - C‑474/24 - NADA Austria and Others NSS - 4749/2026 Cour Administrative - 49701C CJEU - C-205/21 - Ministerstvo na vatreshnite raboti +23 more

Enforcement 3

DPC (Ireland) reprimands Kildare County Council over surveillance tech and CCTV compliance ¶9 DPC (Ireland) reprimands Kildare County Council over surveillance tech and CCTV compliance ¶2 DPC (Ireland) reprimands Kildare County Council over surveillance tech and CCTV compliance

Guidance 2

Guidelines 3/2019 on processing of personal data through video devices ¶31 Guidelines 3/2019 on processing of personal data through video devices

2(3) 10 Case Law 10 Guidance .md

Case Law 10

CJEU - C-205/21 - Ministerstvo na vatreshnite raboti European Commission v Patrick Breyer Thomas Bindl v European Commission Criminal proceedings against V.S ¶18 Thomas Bindl v European Commission ¶46 European Commission v Patrick Breyer ¶15 European Commission v Patrick Breyer ¶166 Ligue des droits humains ASBL v Conseil des ministres +2 more

Guidance 10

Statement 2/2025 on the implementation of the PNR Directive in light of CJEU Judgment C-817/19 Contribution of the EDPB to the European Commission’s evaluation of the Data Protection Law Enforcement Directive (LED) under Article 62 Contribution of the EDPB to the European Commission’s evaluation of the Data Protection Law Enforcement Directive (‘‘LED’’) under Article 62 LED EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 ¶13 Contribution of the EDPB to the European Commission’s evaluation of the Data Protection Law Enforcement Directive (‘‘LED’’) under Article 62 LED ¶13 Statement 2/2025 on the implementation of the PNR Directive in light of CJEU Judgment C-817/19 ¶15 Contribution of the EDPB to the European Commission’s evaluation of the Data Protection Law Enforcement Directive (LED) under Article 62 ¶148 EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 +2 more

2(4) 7 Case Law 11 Guidance .md

Case Law 7

X v Russmedia Digital SRL and Inform Media Press SRL ¶136 X v Russmedia Digital SRL and Inform Media Press SRL ¶135 X v Russmedia Digital SRL and Inform Media Press SRL ¶134 X v Russmedia Digital SRL and Inform Media Press SRL ¶133 X v Russmedia Digital SRL and Inform Media Press SRL ¶43 X v Russmedia Digital SRL and Inform Media Press SRL ¶1 X v Russmedia Digital SRL and Inform Media Press SRL

Guidance 11

EDPB contribution to the EBA public consultation on draft regulatory technical standards on AML/CFT EDPB contribution to the EBA public consultation on draft regulatory technical standards on AML/CFT EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) EDPB-EDPS Joint Opinion 5/2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) ¶146 EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) ¶56 EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) ¶14 EDPB-EDPS Joint Opinion 5/2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) +3 more

Related across sources

C-272/19 VQ v Land Hessen In a preliminary ruling requested by the Verwaltungsgericht Wiesbaden in proceedings between VQ and Land Hessen, the CJEU addressed whether the GDPR applies to the processing of… Third Chamber Jul 9, 2020 Material scope (GDPR) Right of Access Personal Data

C-306/21 Komisia za zashtita na lichnite danni and Tsentralna izbiratelna komisia v Koalitsia „Demokratichna Bulgaria - Obedinenie“ In this preliminary ruling, the Court of Justice of the European Union addressed whether the GDPR applies to the processing of personal data during national and European elections… Eighth Chamber Oct 20, 2022 Material scope (GDPR) Supervision Personal Data

C-33/22 Österreichische Datenschutzbehörde v WK In Case C-33/22, the Court of Justice of the European Union (Grand Chamber) addressed a preliminary reference from the Austrian Verwaltungsgerichtshof regarding whether a… Grand Chamber Jan 16, 2024 Material scope (GDPR) Supervision Public Authority

C-461/22 MK v WB In Case C-461/22, the CJEU addressed a preliminary ruling from the Landgericht Hannover concerning whether a professionally appointed legal guardian qualifies as a "controller"… Ninth Chamber Jul 11, 2024 Material scope (GDPR) Right of Access Personal Data

C-245/20 X and Z v Autoriteit Persoonsgegevens In Case C-245/20, the Court of Justice of the European Union interpreted Article 55(3) GDPR in response to a preliminary reference from the Rechtbank Midden-Nederland concerning… First Chamber Mar 24, 2022 Personal Data Material scope (GDPR) Supervisory Authorities

C-623/17 Privacy International v Secretary of State C-623/17 (Privacy International) Oct 6, 2020 IP Address Material scope (GDPR) Legitimate Interest