Art. 1 GDPR -  Subject-matter and objectives

1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.
2. This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.
3. The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.

What does that mean? 

The GDPR deals exclusively with the protection of personal data of natural persons. Because this is so important, we will repeat what this means from Module 1:

Natural persons

This refers to individual "physical" people as holders of rights and obligations. In contrast, the term "legal person" describes a group of people or an organisation, such as companies, associations or foundations. Data protection therefore only protects people and not organisations.

Example: The XYZ association cannot derive any legal claims for itself from the GDPR, but its employees or members can.

Personal data

It only concerns data that relates to a person or was created by a person:

• Data ABOUT people: Everything that makes us distinguishable from others: our name, home address, date of birth, personal e-mail address, tax number, photos & videos on which we are depicted,...
  
• Data FROM people: Content of messages or data generated in the course of communication activities, such as IP addresses. 

Example: The email address info@my-company.com is not personal data, whereas the email address maria.meyer@my-company.com is.

What is protected?

It is not the data that is at the centre of the GDPR, but the protection of people's fundamental rights.