GDPR

Knowledge Base | GDPR | What is exempt from GDPR?

What is exempt from GDPR?

The GDPR distinguishes between processing outside its scope and exceptions to particular obligations.

Under Article 2 of the GDPR, exclusions include:

  • Processing by individuals for purely personal or household activities.

  • Activities outside EU law, such as national security.

  • Processing by competent authorities for criminal investigation, prosecution or related law enforcement purposes, which generally follows separate legislation.

EU institutions also operate under a separate data protection regime.

Within the GDPR, specific provisions and national laws can allow limited exceptions for activities such as journalism, research or protecting certain public interests. These depend on the applicable legal conditions and do not automatically remove every obligation.

Small businesses and charities have no blanket exemption from GDPR compliance. Any exemption must be assessed against the particular processing activity and requirement.