Article 2 explains the material scope of the regulation, meaning when and where data protection law applies. It sets out the types of data processing activities that are covered and clarifies which activities fall outside the regulation. This helps organisations and individuals understand whether the rules apply to a particular situation.
The article states that the regulation applies to the processing of personal data by automated means, such as computers and digital systems, as well as to manual processing if the data forms part of a structured filing system. This means that most modern data handling, whether digital or organised paper records, is covered. However, purely personal or household activities, such as keeping a personal address book or family photos, are excluded.
Article 2 also explains several important exemptions, including data processed for national security purposes and certain law enforcement activities, which are covered by separate legal frameworks. These exemptions ensure that sensitive areas like security and crime prevention can operate effectively while still respecting privacy where possible.
1. General scope of the regulation
The first part of Article 2 explains what types of data processing are covered by the regulation. It states that the rules apply to the processing of personal data, whether it is done by automated means (like computers or apps) or manual means (like paper records), as long as the data is part of a structured filing system.
This means that most modern data handling—digital or organised manual records—is included under the law, so organisations cannot avoid compliance simply because they use paper instead of digital systems.
2. Exclusions from the regulation
Article 2 also lists cases where the regulation does not apply. Key exclusions include:
- Personal or household activities: Processing personal data purely for private use, such as keeping a personal contact list or family photo album, is not covered.
- National security purposes: Data processed for military or security reasons is usually governed by separate laws.
- Law enforcement activities related to criminal investigations or prosecutions, which may fall under other legal frameworks.
These exclusions make clear that the regulation is focused on public and commercial data processing, not private or highly specialised state matters.
3. Implications of the scope
By defining what is included and excluded, Article 2 ensures that organisations and individuals know when the law applies. It prevents confusion over whether a certain type of data processing is regulated. This is important for compliance, accountability, and enforcement.
4. Foundation for the rest of the regulation
Finally, Article 2 sets the boundaries for all other articles. Everything in the regulation, including obligations for controllers, processors, and the rights of data subjects, only applies if the processing falls within this material scope.
| Section / Point | Summary | Notes / Examples |
|---|---|---|
| General scope | Applies to processing of personal data by automated means or manual filing systems. | Digital systems, apps, spreadsheets, and structured paper records. |
| Exclusion – personal/household | Data processed purely for private/household use is not covered. | Personal address books, family photos. |
| Exclusion – national security | Processing for military, security, or state intelligence purposes is excluded. | Separate laws govern these cases. |
| Exclusion – law enforcement | Processing related to criminal investigations or prosecutions is excluded. | Often covered by other legislation (e.g., Police Acts). |
| Implications | Defines when the regulation applies, ensuring clarity for organisations and individuals. | Organisations know whether GDPR/UK GDPR rules must be followed. |
| Foundation for other articles | All subsequent obligations and rights apply only if processing falls within this scope. | Sets boundaries for controllers, processors, and data subjects. |
Article 1 – Article 2, Article 3, Article 4, Article 5, Article 6, Article 7 , Article 8