Skip to main content
Praxikon
Agent check

Article 2: Material scope

Praxikon tracks Article 2 (Material scope) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IIn force since 25-05-2018

Official text

/
This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.
This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c) by a natural person in the course of a purely personal or household activity; (d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.
For the processing of personal data by the Union institutions, bodies, offices and agencies, Regulation (EC) No 45/2001 applies. Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with Article 98.
This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

Cross-references

Art. 98: Review of other Union legal acts on data protection

More case law, guidelines and fines

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (7)

  • 7 March 2024 · C-740/22 · CJEU
    Endemol Shine Finland

    Orally disclosing information about criminal proceedings is processing if the information is or will be in a filing system. Such data may not be disclosed to anyone without the requester showing a specific interest.

  • 16 January 2024 · C-33/22 · CJEU
    Österreichische Datenschutzbehörde (committee of inquiry)

    A parliamentary committee of inquiry in principle falls under the GDPR. The national security exception is narrow, and the national supervisory authority is competent.

  • 9 July 2020 · C-272/19 · CJEU
    VQ v Land Hessen (petitions committee)

    The petitions committee of a regional parliament that determines purposes and means is a controller and falls under the GDPR, including the right of access.

  • 14 February 2019 · C-345/17 · CJEUDirective 95/46
    Buivids

    Filming police officers at a station and posting the video online falls within data protection law. It can be processing for journalistic purposes if the sole aim is to share information or ideas with the public.

  • 10 July 2018 · C-25/17 · CJEUDirective 95/46
    Jehovan todistajat

    Notes taken by members of a religious community during door-to-door preaching are not a household activity and can form a filing system. The community is a joint controller with its members, even without access to the data itself.

Show 2 more
  • 11 December 2014 · C-212/13 · CJEUDirective 95/46
    Ryneš

    A camera on a family home that also films the public road does not fall within the household exemption.

  • 6 November 2003 · C-101/01 · CJEUDirective 95/46
    Lindqvist

    Naming people on a web page is automated processing that falls outside the household exemption; a foot injury is health data, and uploading to an EU-hosted site is not a transfer to a third country.

Guidelines (2)

  • 13 October 2026 · Statement 1/2026 · EDPB
    Statement 1/2026 on smart glasses

    Preliminary reflections: a narrow exemption for purely personal use, the producer and the provider of a linked service (including AI) can be controllers, and bystanders must notice at that moment that recording is taking place.

  • 29 January 2020 · v2.1 · EDPB
    Guidelines 3/2019 on processing of personal data through video devices

    Covers video surveillance under the GDPR, including the household exemption, legal basis, biometric data, transparency duties and storage periods.

Line of case lawScope

When does the GDPR apply, also outside the EU, and what does the household exemption cover?

  1. Lindqvist (2003)Publishing on the internet is not a household activity.
  2. Google Spain (2014)A sales establishment in the EU brings the processing under EU law.
  3. Ryneš (2014)A camera filming the public road is not covered by the exemption.
  4. Weltimmo (2015)A minimal but real activity is already an establishment.
  5. Jehovan todistajat (2018)Door-to-door preaching is not a personal activity.
  6. Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) (2019)The EDPB works out the establishment and targeting criteria.
  7. Google v CNIL (2019)De-referencing applies across the EU.
  8. Österreichische Datenschutzbehörde (committee of inquiry) (2024)A parliamentary committee of inquiry also falls under the GDPR.

Checked on 5 November 2026

← Art. 1: Subject-matter and objectivesArt. 3: Territorial scope →

Connections

What connects to Article 2 GDPR

Case law

Guidelines