Does GDPR apply to individuals?

Individuals can have obligations under GDPR when they process other people’s personal data outside purely personal or household activities. This includes individuals acting as freelancers or sole traders, provided their processing falls within GDPR’s scope.

Under Article 2(2)(c), the personal or household exemption generally covers activities such as keeping a private address book, exchanging personal messages or sharing family photographs within a private circle.

Activities that can fall outside this exemption include:

• A freelancer or sole trader keeping customer records for their work.

• Publishing identifiable information about other people to an unrestricted online audience.

• Operating home CCTV that also records people on public streets or neighbouring property.

Where GDPR applies, an individual deciding why and how the information is processed acts as a data controller. They must meet the relevant requirements, including having a lawful basis, providing privacy information, securing the data and respecting individual rights. The assessment depends on the activity and GDPR’s territorial rules.