Fundamental concepts

Question 1

What is the material scope of GDPR?

Answer 1

Article 2

• Processing (any action) of
• Personal data (identified or identifiable)
• By automated and non-automated means
• Forming part of a filing system or intended to do so

Question 2

What are the exceptions to the material scope?

Answer 2

Article 2(2)

(a) Activity falls outside of EU law scope
(b) Activity by MS regarding foreign and security policy
(c) Purely personal or household activity

Question 3

What is the territorial scope of GDPR?

Answer 3

Article 3 - extraterrirotiality

1) Activity of an establishment of a controller/processor within EU, regardless of where processing takes place
2) Establishment outside of EU but offering goods or services to EU data subjects OR behavioural monitoring of EU data subjects (you’re targeted by EU law when you target subjects in EU)
3) Not established in EU but a place where MS law applies by virtue of public international law (embassies)