Which does GDPR not apply to?

GDPR has its limits—it doesn’t cover data used purely for personal or household activities, with no ties to business or commercial matters. Law enforcement data handling for criminal investigations or national security also falls outside GDPR, as it’s covered by different rules.

If data processing happens outside the EU/EEA and doesn’t involve targeting people there, GDPR won’t apply. Plus, EU institutions follow their own set of rules, separate from GDPR.