GDPR is a regulation that applies to any business, organization, or individual processing or collecting the data of EU residents. However, it is also important to note and understand that as stated in Article 2 of Chapter 1, the GDPR is not applicable if the individual collects personal data for a “purely personal or household activity.”
However, individuals may be subject to GDPR if the processing activity goes beyond domestic or personal activity. Elaborating more on this we have explained different scenarios wherein an individual may be subjected to GDPR.
In a scenario where a sole trader such as plumbers may also be subjected to GDPR as the activity of processing the data is not personal or household which is exempted. Similarly, if a person is running a forum on Facebook with several people in it then they too are subjected to the regulation of GDPR.
This is simply because it involves data of several people who have no personal connection and the data processing is not personal or household in nature. So, it does not really make a difference if you are an individual or a company, it is about the nature of data and the way of processing those data.
If you are an individual who processes personally identifiable data on behalf of someone else under their instruction, then you are a processor and must comply with GDPR as required for a processor. However, in the case of an individual like an employee or an agent working on behalf of an organization then it is the organization and not the individual who is the processor or controller. But again it all depends on the relationship and the agreement signed with the organization. In all cases, the GDPR Regulation applies if the individual, organization, or business processes personal data of EU citizens for any reason other than personal or household activity.
If you still have doubts on what activities fall in the ambit of GDPR then feel free to contact our expert compliance team at VISTA InfoSec to guide you. Our experts can guide you on whether or not GDPR applies to you as an individual. If yes, then our team can conduct a thorough analysis and scope the activities to verify whether or not the activities are GDPR Compliant.
