When does GDPR not apply?

GDPR does not apply in several specific situations. For example, it won’t cover data processing that is purely personal or household-related, where there is no connection to professional or commercial activities. It also won’t apply to data processing carried out for national security or criminal law enforcement purposes because these areas are governed by separate regulations.

GDPR does not regulate data processing by EU institutions, which follow their own data protection rules, or any processing activities that occur outside the EU’s territorial scope unless they involve offering goods or services to or monitoring the behavior of EU residents.