Does GDPR apply to individuals?

Yes, individuals can be subject to the GDPR, if their data processing is beyond the scope of “purely personal or household activity” as defined in Article 2 of the GDPR. The regulation does not apply to the processing of personal data by a natural person for purely personal or household activity. 

The definition of what constitutes a “personal or household” activity is contested. An often-cited and relevant case (C-101/01, paragraph 47) by the European Court of Justice notes that:

“That exception must therefore be interpreted as relating only to activities which are carried out in the course of private or family life of individuals, which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people”.