GDPR Recital 14: the Regulation protects natural persons, not companies (Regulation (EU) 2016/679, recital 14)
Records about companies (a supplier's name, its legal form, its general contact details, its prices) are outside the GDPR. The names and details of the people who work at those companies are not, so a record about a business can still hold personal data.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person.”
Where it was read
Also read from the same source
- GDPR Article 5(1)(b): purpose limitation (Regulation (EU) 2016/679, Art 5(1)(b))
- GDPR Article 6(1)(f): legitimate interests as a lawful basis (Regulation (EU) 2016/679, Art 6(1)(f))
- GDPR Article 6(4): compatibility test for a new purpose (Regulation (EU) 2016/679, Art 6(4))
- GDPR Recital 50: further processing and the legal basis (Regulation (EU) 2016/679, recital 50)
- GDPR Article 9(1): special categories of personal data (Regulation (EU) 2016/679, Art 9(1))
- GDPR Article 13(3): telling people before a new purpose (Regulation (EU) 2016/679, Art 13(3))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 2 guides