# Material scope — GDPR — context bundle > Focused context for a single provision, curated from overview.legal on 2026-08-22. Canonical page: https://overview.legal/laws/gdpr/art-2 > Every item cites its source. Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it. ## Provision ### Material scope — Material scope *GDPR, gdpr-art-2-en — https://overview.legal/laws/gdpr/art-2* 1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. 2. This Regulation does not apply to the processing of personal data: a) in the course of an activity which falls outside the scope of Union law; b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; c) by a natural person in the course of a purely personal or household activity; d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. 3. For the processing of personal data by the Union institutions, bodies, offices and agencies, Regulation (EC) No 45/2001 applies. Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with Article 98. 4. This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive. ## Related recitals ### Recital 13 — consistent Union-wide data protection regulation In order to ensure a consistent level of protection for natural persons throughout the Union and to prevent divergences hampering the free movement of personal data within the internal market, a Regulation is necessary to provide legal certainty and transparency for economic operators, including micro, small and medium-sized enterprises, and to provide natural persons in all Member States with the same level of legally enforceable rights and obligations and responsibilities for controllers and processors, to ensure consistent monitoring of the processing of personal data, and equivalent sanctions in all Member States as well as effective cooperation between the supervisory authorities of different Member States. The proper functioning of the internal market requires that the free movement of personal data within the Union is not restricted or prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data. To take account of the specific situation of micro, small and medium-sized enterprises, this Regulation includes a derogation for organisations with fewer than 250 employees with regard to record-keeping. In addition, the Union institutions and bodies, and Member States and their supervisory authorities, are encouraged to take account of the specific needs of micro, small and medium-sized enterprises in the application of this Regulation. The notion of micro, small and medium-sized enterprises should draw from Article 2 of the Annex to Commission Recommendation 2003/361/EC (5). ## Enforcement 74 decision(s) on record cite Article 2, totalling approximately €6,480,500 in fines (median €6,000). Top fines: - **Foodinho Srl: Non-compliance with general data processing principles** (ITALY, €5,000,000) — https://overview.legal/posts/48646 - **Ama S.p.a.: Insufficient legal basis for data processing** (ITALY, €239,000) — https://overview.legal/posts/48030 - **Bocconi University: Non-compliance with general data processing principles** (ITALY, €200,000) — https://overview.legal/posts/46991 - **Roma Capitale: Non-compliance with general data processing principles** (ITALY, €176,000) — https://overview.legal/posts/48029 - **Veneto region: Insufficient legal basis for data processing** (ITALY, €100,000) — https://overview.legal/posts/47784 ## Guidance ### Opinion 15/2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal to be used as tool for transfers pursuant to Articles 42 and 46 GDPR *EDPB — https://overview.legal/posts/125681* Opinion 15 / 2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal to be used as tool for transfers pursuant to Articles 42 and 46 GDPR Adopted on 15 April 2026 1 | Adopted 2 | Adopted The European Data Protection Board Having regard to Article 63, Article 64(2), Article 42 and Article 46 of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to… ### EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework ( *EDPB — https://overview.legal/posts/53739* EDPB, EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus) ### Contribution of the EDPB to the European Commission’s evaluation of the Data Protection Law Enforcement Directive (‘‘LED’’) under Article 62 LED *EDPB — https://overview.legal/posts/53750* EDPB, Contribution of the EDPB to the European Commission’s evaluation of the Data Protection Law Enforcement Directive (‘‘LED’’) under Article 62 LED ### Opinion 14/2025 on the draft decision of the Norwegian Supervisory Authority regarding the Controller Binding Corporate Rules of the Wilh. Wilhelmsen Group *EDPB — https://overview.legal/posts/51078* EDPB, Opinion 14/2025 on the draft decision of the Norwegian Supervisory Authority regarding the Controller Binding Corporate Rules of the Wilh. ### Statement 5/2024 on the Recommendations of the High-Level Group on Access to Data for Effective Law Enforcement *EDPB — https://overview.legal/posts/125706* Statement 5/2024 on the Recommendations of the High - Level Group on Access to Data for Effective Law Enforcement Adopted on 4 November 2024 The European Data Protection Board has adopted the following statement: In June 2023 the High - Level Group on Access to Data for Effective Law Enforcement (‘HLG’) was launched by the Presidency of the Council and the European Commission to explore “ challenges that law enforcement practitioners in the Union face in their daily work in connection to access… ## Related topics - **Material scope (GDPR)** — https://overview.legal/topics/material-scope ## Legal Framework --- Generated by overview.legal · https://overview.legal/laws/gdpr/art-2 · 2026-08-22