--- title: "Art. 2 GDPR: Material scope" canonical: "https://dposchool.com/gdpr/article/2" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_2" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 2 GDPR · Chapter I: General provisions # Article 2 GDPR: Material scope Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) The Regulation applies to processing of personal data wholly or partly by automated means, and to other processing of data that form or are meant to form part of a filing system. It does not apply to the cases listed in paragraph 2, such as purely personal or household activity and processing by competent authorities for criminal law enforcement. ## Official text ### Article 2(1) **1.** This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. ### Article 2(2) **2.** This Regulation does not apply to the processing of personal data: #### Article 2(2)(a) **(a)** in the course of an activity which falls outside the scope of Union law; #### Article 2(2)(b) **(b)** by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; #### Article 2(2)(c) **(c)** by a natural person in the course of a purely personal or household activity; #### Article 2(2)(d) **(d)** by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. ### Article 2(3) **3.** For the processing of personal data by the Union institutions, bodies, offices and agencies, Regulation (EC) No 45/2001 applies. Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with Article 98. ### Article 2(4) **4.** This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 2 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_2) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 2](https://dposchool.com/gdpr/recital/2) - [Recital 13](https://dposchool.com/gdpr/recital/13) ## Court of Justice judgments ### [C-474/24, AR and Others v Österreichische Datenschutzbehörde and Others](https://dposchool.com/gdpr/case/c-474-24) Judgment of 14 July 2026 · ECLI:EU:C:2026:579 Publishing the names and sanctions of athletes who broke anti-doping rules falls within the GDPR; it is not in principle health data unless the substance or method reveals health information; national law may require publication if it allows an individual balancing and excludes recreational athletes, vulnerable persons and whistleblowers. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-474/24&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0474) ### [C-492/23, X v Russmedia Digital SRL and Inform Media Press SRL](https://dposchool.com/gdpr/case/c-492-23) Judgment of 2 December 2025 · ECLI:EU:C:2025:935 An online marketplace operator is a controller of personal data in ads published on its site; before publication it must identify ads with sensitive data, check the advertiser is the person concerned or has explicit consent, take security measures against copying, and cannot rely on the hosting exemptions of the e-Commerce Directive for these GDPR duties. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-492/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0492) ### [C-33/22, Österreichische Datenschutzbehörde v WK](https://dposchool.com/gdpr/case/c-33-22) Judgment of 16 January 2024 · ECLI:EU:C:2024:46 A national parliament's committee of inquiry is not outside the GDPR merely because it scrutinises the executive or investigates a security agency; where the Member State has a single supervisory authority, that authority can hear complaints about the committee. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-33/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0033) ### [C-311/18, Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems](https://dposchool.com/gdpr/case/c-311-18) Judgment of 16 July 2020 · ECLI:EU:C:2020:559 Transfers under standard contractual clauses require essentially equivalent protection, assessed case by case including access by foreign authorities; authorities must suspend or prohibit transfers that cannot be protected; the Commission's SCC decision stays valid; the EU-US Privacy Shield decision is invalid. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-311/18&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311) ### Related (earlier law or other instruments) #### [C-25/17, Proceedings brought by Tietosuojavaltuutettu](https://dposchool.com/gdpr/case/c-25-17) Judgment of 10 July 2018 · ECLI:EU:C:2018:551 Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR) Notes taken by members of a religious community during door-to-door preaching are not a purely personal activity and can form a filing system; the community can be a controller jointly with its members even without access to the data. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-25/17&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0025) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter I](https://dposchool.com/gdpr/chapter/1) / Article 2 Previous: [Art. 1 GDPR: Subject-matter and objectives](https://dposchool.com/gdpr/article/1) Next: [Art. 3 GDPR: Territorial scope](https://dposchool.com/gdpr/article/3) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents