A private individual keeps a Christmas card address list for family and friends with no connection to a trade or profession. A colleague claims this list is GDPR-covered business processing. Which material-scope view is correct?
Select an answer to reveal the explanation.
Short Explanation
A shoebox of holiday addresses for your own family night is not a customer CRM. The GDPR leaves purely personal and household activity alone. Digitize the shoebox for the same private purpose and it still is not a business processing file.
Full Explanation
Article 2(2)(c) excludes processing by a natural person in the course of a purely personal or household activity. A private Christmas card list with no professional link fits that exclusion. Format (paper vs digital) does not convert household use into GDPR-covered business processing. The exemption is about the nature of the activity, not the age of the list-keeper.