european-union data-protection gdpr
Does the EU GDPR apply to these types of natural persons?
<p>Does the GDPR apply to a website operator who is a natural person (not a company or non-profit) and</p>

<ul>
<li>uses the website directly for commercial activity</li>
<li>uses the website to advertise his/her other services or connect to potential clients</li>
<li>is not engaged in any economic activity</li>
</ul>

<p>If you're storing/processing personal data of individuals within the EU for any commercial purposes (whether captured through your website or other means) then under GDPR you will be considered a Data Controller, whether you are a registered company or self-employed makes no difference.</p>
<p>The GDPR definition of '<em>controller</em>' in Article 4 is:</p>
<blockquote>
<p>‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;</p>
<p>(<a href="http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679" rel="nofollow noreferrer">GDPR</a>, Article 4(7): Definitions, p.33)</p>
</blockquote>
<p>The scope of the regulation (whether it applies to you) is defined in Article 3:</p>
<blockquote>
<ol>
<li><p>This Regulation applies to the processing of personal data in the context of <strong>the activities of an establishment of a controller or a processor in the Union</strong>, regardless of whether the processing takes place in the Union or not.</p>
</li>
<li><p>This Regulation applies to the processing of <strong>personal data of data subjects who are in the Union by a controller or processor not established in the Union</strong>, where the processing activities are related to: <strong>(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union;</strong> or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.</p>
</li>
</ol>
<p>(<a href="http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679" rel="nofollow noreferrer">GDPR</a>, Article 3: Territorial Scope, p.32-33)</p>
</blockquote>
<p>Therefore to conclude and clarify in response to your questions:</p>
<ul>
<li><p>The applicability of GDPR to you depends on the criteria in Article 3, being a website owner/operator makes no real difference in this context. Since you are offering goods/services, if you are processing personal information about EU individuals then it <strong>will</strong> apply regardless of whether you're based within the EU or not.</p>
</li>
<li><p>Since you state the website is for commercial activity, the exemption in Article 2(2c) for when the data is processed solely for personal or household activity will not apply.</p>
</li>
<li><p>GDPR applies in the context of offering goods or services, <em>regardless</em> of whether any payments are taken or not - Article 3(2a).</p>
</li>
</ul>
