The GDPR Article 2 defines the material scope the regulation. Article 2 (2)c states that this regulation does not apply to the processing of personal data:
by a natural person in the course of a purely personal or household activity;
This sentence is known as the personal use exemption. When this was included in the GDPR, the drafters decided to keep the personal use exemption unchanged from the article 3(2) of Directive 95/46. (There as a lot of lobbying for removing "purely" from the sentence – but drafters wanted to keep it.)
There also an unofficial description in Recital 18, that say:
(1) This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. (2) Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. (3) However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.
This says that you're not exempt for processing that has connection to a professional or commercial activity. But it is very ague on what makes you exempt. Does "social networking" include maintaining your own blog, or are they only referring to your activities on Facebook and similar "social" media where you obviously are not the controller (the controller is who owns and runs the platform)?
A key question, partly arising from a lengthy discussion thread under the answer by @Greendrake in this related question, is whether this means that a publicly accessible, personal blog is excluded from the scope of the GDPR?
To answer this question, one need to consider that the GDPR Article 4 definition 1 says that:
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
We know from EU case law that this also includes IP-addresses, since such online identifiers indirectly makes people who is visiting such a publicly available personal blog identifiable.
Also, note that the scope of the GDPR is processing of personal data. This is defined in GDPR Article 4 defintion 2:
‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
Some critics of the GDPR have objected that such a definition of ‘processing’ is over-reaching. However, it being over-reaching does not mean that we should ignore it.
In conclusion, I would like to link to two seminal cases heard by the ECJ:
Central to both cases was the question of whether the processing activities of an individual was covered by personal use exemption under article 3(2) of Directive 95/46. In both these cases, the ECJ took an extremely restrictive view, and concluded that the personal use exemption did not apply to the processing done by these individuals.
The questions is: Is it possible for a publicly accessible, personal blog to make use of the personal use exception of the GDPR to avoid having to comply with the regulation? If "yes": What need to be considered by its owner?