Where and to whom does the GDPR apply?

With regard to the applicability of the GDPR, a distinction must be made between the so-called territorial and the material scope of application:

Geographically, the GDPR applies throughout the EU and the EEA. #

According to the market location principle, this applies not only to European companies, but also to companies outside the EU or the EEA that offer their services in the EU or maintain a branch within the EU or the EEA and thus also target the European market.

In fact, the GDPR applies to all fully or partially automated processing of personal data as well as to the non-automated processing of personal data that is stored or is to be stored in a file system.

This means that the principles of the GDPR must be considered not only when processing personal data with a computer, but also when it comes to analog personnel files or invoices, for example.

An exception to this, however, is the processing of personal data "by natural persons to carry out exclusively personal or family activities". This includes, for example, correspondence and keeping address books as well as sending private birthday invitations etc.