Does the GDPR apply to a website operator who is a natural person (not a company or non-profit) and

  • uses the website directly for commercial activity
  • uses the website to advertise his/her other services or connect to potential clients
  • is not engaged in any economic activity

2 Answers 2


If you're storing/processing personal data of individuals within the EU for any commercial purposes (whether captured through your website or other means) then under GDPR you will be considered a Data Controller, whether you are a registered company or self-employed makes no difference.

The GDPR definition of 'controller' in Article 4 is:

‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

(GDPR, Article 4(7): Definitions, p.33)

The scope of the regulation (whether it applies to you) is defined in Article 3:

  1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.

  2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

(GDPR, Article 3: Territorial Scope, p.32-33)

Therefore to conclude and clarify in response to your questions:

  • The applicability of GDPR to you depends on the criteria in Article 3, being a website owner/operator makes no real difference in this context. Since you are offering goods/services, if you are processing personal information about EU individuals then it will apply regardless of whether you're based within the EU or not.

  • Since you state the website is for commercial activity, the exemption in Article 2(2c) for when the data is processed solely for personal or household activity will not apply.

  • GDPR applies in the context of offering goods or services, regardless of whether any payments are taken or not - Article 3(2a).


I haven't waded through the legal text, but it is vanishingly unlikely that the GDPR does not apply to a natural person when it does apply to a non-natural legal person. Your question then boils down to "when does it apply?"

According to this website

If you process data about individuals in the context of selling goods or services to citizens in other EU countries then you will need to comply with the GDPR ...

(I think the "other" is only there because the FAQ is in the context of Brexit. I am pretty sure the GDPR applies within an EU country.)

Thus the answers to your questions are

  1. Definitely yes
  2. Almost certainly yes
  3. Definitely not
  • Any explanation for the downvote? Specifically, how I could improve the answer? Mar 14, 2018 at 20:37
  • Ah! Almost certainly my answer to Q3, which is taken fairly directly from the linked website - but is contradicted by the actual regulations quoted by @richhallstoke. Mar 14, 2018 at 20:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .