EUTechRegResearch
MenuClose menu
Digital Omnibus legislative tracker
Texts to 22 Oct 2026

Article 2 – Material scope

Only Parliament amendments would change this article. Parliament committees have tabled 6 amendments to this article.

Latest text22 October 2026ST 14756/26

Contains no amendment to this article.

What each text does

  1. 19 Nov 2025 Commission proposalCOM(2025) 837 No amendment to this article.
  2. 21 May 2026 Council textST 9547/26 No amendment to this article.ST 9547/26 reproduces only some of the proposal’s changes, so this comparison applies only those it shows or visibly drops. It says nothing about the others.
  3. 10 Jun 2026 Council textST 10426/26 No amendment to this article.
  4. 18 Jun 2026 Council textST 10677/26 No amendment to this article.
  5. 27 Jul 2026 ITRE–LIBE amendments 777–1052 to the draft reportCJ72-AM-791072 4 amendments to this article. Amendments in this document
  6. 27 Jul 2026 ITRE–LIBE amendments 1565–1740 to the draft reportCJ72-AM-791874 2 amendments to this article. Amendments in this document
  7. 3 Sep 2026 Council textST 12535/26 No amendment to this article.
  8. 2 Oct 2026 Council textST 13886/26 No amendment to this article.Page 126 prints “(9a)” without an instruction or target, so no change can be assigned to that marker.
  9. 22 Oct 2026 Council textST 14756/26 No amendment to this article.

Parliament amendments

6 amendments to this article

3 propose alternative wording and 3 would add wording.

By political group; co-sponsored amendments count for each group
TypeS&DEPP
~ Alternative12
+ Addition·3

By political group

  • ~ Alternative S&D 1 EPP 2
  • + Addition EPP 3

Show

Article 2 as a whole1 amendment

  1. 925 Alternative Marina Kaljurand +8S&D · ITRE–LIBE “3a. This Regulation applies to the storing of information, or gaining of access to information already stored, in terminal equipment of users.”

    -1 a Article 2 is replaced by the following:

    "Material scope 1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. 2. This Regulation does not apply to the processing of personal data: (a)in the course of an activity which falls outside the scope of Union law; (b)by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c)by a natural person in the course of a purely personal or household activity; (d)by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. 3. For the processing of personal data by the Union institutions, bodies, offices and agencies, Regulation (EC) No 45/2001 applies. Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with Article 98. 3a. This Regulation applies to the storing of information, or gaining of access to information already stored, in terminal equipment of users. 4. This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive."

    Justification

    This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.

    Tabled by
    Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
    Group
    S&D
    Targets
    GDPR Article 2
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph -1 a (new) / Regulation (EU) 2016/679 / Article 2

Paragraph (2)1 amendment

  1. 924 Alternative Axel VossEPP · ITRE–LIBE “(da) by natural or legal persons for non-professional or non-commercial purposes; (db) in the course of an activity that is likely to result in a low…”

    -1 a In Article 2, four new points are added to paragraph 2:

    2. This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c) by a natural person in the course of a purely personal or household activity; (d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; (da) by natural or legal persons for non-professional or non-commercial purposes; (db) in the course of an activity that is likely to result in a low risk to the rights and freedoms of natural persons; (dc) by micro, small and medium-sized enterprises; (dd) which is of a purely incidental or transitory nature and is carried out for a purpose unrelated to the data subject as an identified or identifiable natural person."

    Justification

    SCOPE EXCLUSION #1: This amendment offers an alternative to the proposed risk-based simplification package by excluding non-commercial, low-risk, SME and purely incidental processing from the GDPR’s full scope. It does not deregulate such processing: Member States must ensure protection through other suitable laws, including private-life, contract, consumer, labour, tort, unfair-competition and criminal law. This reduces disproportionate administrative burdens, supports data flows and focuses GDPR enforcement on processing that creates real risks for individuals.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 2 – paragraph 2
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph -1 a (new) / Regulation (EU) 2016/679 / Article 2 – paragraph 2

New points in paragraph 22 amendments

  1. 1596 Addition Angelika Niebler +1EPP · ITRE–LIBE “by a natural person in the course of an activity carried out entirely on a voluntary basis, unless that activity involves a type of processing listed…”

    The following point (da) is added to Article 2(2)

    (da)by a natural person in the course of an activity carried out entirely on a voluntary basis, unless that activity involves a type of processing listed pursuant to Article 35(4) GDPR.'

    Tabled by
    Angelika Niebler, Monika Hohlmeier
    Group
    EPP
    Targets
    GDPR Article 2 – paragraph 2 – point da (new)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 3 – paragraph 1 – subparagraph 1 (new) / Regulation (EU) 2016/679 / Article 2 – paragraph 2 – point da (new)
  2. 1601 Addition Andrea Wechsler +8EPP · ITRE–LIBE “by associations, foundations and other non-profit organisations established in the Union, where the processing is carried out solely in the course of…”

    In Article 2, the following point e is added:

    ‘(e) by associations, foundations and other non-profit organisations established in the Union, where the processing is carried out solely in the course of their statutory non-commercial activities and is limited to the administration of members, former members, volunteers, donors or beneficiaries, provided that such processing does not involve systematic monitoring or processing likely to result in a high risk to the rights and freedoms of natural persons within the meaning of Article 35, and that the personal data are not disclosed to third parties for commercial purposes.’

    Wider passage printed with the amendment

    2.This Regulation does not apply to the processing of personal data:

    (a)in the course of an activity which falls outside the scope of Union law;

    (b)by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU;

    (c)by a natural person in the course of a purely personal or household activity;

    Justification

    Associations, foundations and other non-profit organisations generally process personal data within clear, direct and non-commercial relationships with their members, volunteers, donors or beneficiaries. Subjecting such limited and low-risk processing to the full scope of Regulation (EU) 2016/679 places a disproportionate administrative burden on civil-society and volunteer-based organisations, many of which lack dedicated compliance structures. This targeted exclusion complements the specific simplifications proposed for Articles 13, 14 and 30, while preserving the application of the Regulation to systematic monitoring, automated decision-making, high-risk processing and the commercial disclosure of personal data.

    Tabled by
    Andrea Wechsler, Marie-Sophie Lanig, Stefan Köhler, Alexandra Mehnert, Lena Düpont, Angelika Niebler, Verena Mertens, Christian Doleschal, Sabine Verheyen
    Group
    EPP
    Targets
    GDPR Article 2 – paragraph 2 – point e (new)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 3 – paragraph 1 c (new) / Regulation (EU) 2016/679 / Article 2 – paragraph 2 – point e (new)

Paragraph (4a)1 amendment

  1. 923 Alternative Axel VossEPP · ITRE–LIBE “4a. Articles [19, 20, 27, 30, 35 to 39] of this Regulation do not apply to small controllers."”

    No equivalent-1 Article 2 is amended by adding the following paragraph:

    4a. Articles [19, 20, 27, 30, 35 to 39] of this Regulation do not apply to small controllers."

    Justification

    RISK-BASED APPROACH #4: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 2 – paragraph 4a
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph -1 (new) / Regulation (EU) 2016/679 / Article 2 – paragraph 4a

New paragraphs1 amendment

  1. 926 Addition Axel VossEPP · ITRE–LIBE “Member States shall ensure that the processing of personal data that is exempted from the scope of this Regulation pursuant to paragraphs […] is…” numbered 4a

    – In Article 2, a new paragraph is added after paragraph 4

    4a.Member States shall ensure that the processing of personal data that is exempted from the scope of this Regulation pursuant to paragraphs […] is subject to the obligations of other laws than data protection law, including legislation on the protection of private and family life, contract law, tort law, unfair competition law, consumer law, labor law and criminal law. These other laws shall meet objectives of general interest, especially the free flow of data, and, subject to the principle of proportionality, strike a fair balance between all persons involved in or affected by the data processing."

    Justification

    SCOPE EXCLUSION #2: This amendment offers an alternative to the proposed risk-based simplification package by excluding non-commercial, low-risk, SME and purely incidental processing from the GDPR’s full scope. It does not deregulate such processing: Member States must ensure protection through other suitable laws, including private-life, contract, consumer, labour, tort, unfair-competition and criminal law. This reduces disproportionate administrative burdens, supports data flows and focuses GDPR enforcement on processing that creates real risks for individuals.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 2 – paragraph 4 (new)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point -1 (new) / Regulation (EU) 2016/679 / Article 2 – paragraph 4 (new)