14 / 176
INTRODUCTION
REGULATION
12
small and medium-sized enterprises should draw from Article 2 of the
Annex to Commission Recommendation 2003/361/EC (5).
(14) The protection afforded by this Regulation should apply to natural
persons, whatever their nationality or place of residence, in relation to
the processing of their personal data. This Regulation does not cover
the processing of personal data which concerns legal persons and in
particular undertakings established as legal persons, including the
name and the form of the legal person and the contact details of the
legal person.
(15) In order to prevent creating a serious risk of circumvention, the
protection of natural persons should be technologically neutral and
should not depend on the techniques used. The protection of natural
persons should apply to the processing of personal data by automated
means, as well as to manual processing, if the personal data are
contained or are intended to be contained in a filing system. Files or sets
of files, as well as their cover pages, which are not structured according
to specific criteria should not fall within the scope of this Regulation.
(16) This Regulation does not apply to issues of protection of fundamental
rights and freedoms or the free flowof personal data related to activities
which fall outside the scope of Union law, such as activities concerning
national security. This Regulation does not apply to the processing of
personal data by the Member States when carrying out activities in
relation to the common foreign and security policy of the Union.
(17) Regulation (EC) No 45/2001 of the European Parliament and of the
Council (6) applies to the processing of personal data by the Union
institutions, bodies, offices and agencies. Regulation (EC) No 45/2001
and other Union legal acts applicable to such processing of personal
data should be adapted to the principles and rules established in
this Regulation and applied in the light of this Regulation. In order to
provide a strong and coherent data protection framework in the Union,
the necessary adaptations of Regulation (EC) No 45/2001 should follow
after the adoption of this Regulation, in order to allow application at
the same time as this Regulation.
(18) This Regulation does not apply to the processing of personal data
by a natural person in the course of a purely personal or household
activity and thus with no connection to a professional or commercial
activity. Personal or household activities could include correspondence
and the holding of addresses, or social networking and online activity
undertaken within the context of such activities. However, this
Regulation applies to controllers or processors which provide the
means for processing personal data for such personal or household
activities.
(19) The protection of natural persons with regard to the processing
of personal data by competent authorities for the purposes of the
prevention, investigation, detection or prosecution of criminal offences
or the execution of criminal penalties, including the safeguarding
against and the prevention of threats to public security and the free
movement of such data, is the subject of a specific Union legal act. This
Regulation should not, therefore, apply to processing activities for those
purposes. However, personal dataprocessedbypublic authorities under