What individuals are protected under GDPR?

GDPR protects living individuals, known as data subjects, when the processing of their personal data falls within its scope. This includes adults and children, and protection is not limited to EU citizens.

Two important situations determine coverage:

• EU/EEA establishment: Processing in the context of an organisation’s EU/EEA establishment can be covered regardless of where the individual lives.

• Targeting people in the EU/EEA: An organisation outside the EU/EEA can be covered when it offers goods or services to people there or monitors their behaviour there.

For example, a non-EU citizen visiting the EU may be protected when a business targets them with services during their stay. EU citizenship alone, however, does not bring every overseas activity within GDPR territorial scope. The circumstances of the processing determine whether the regulation applies.