1The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. 2This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person.
Title is an unofficial description, added for readability.
People are protected, companies are not
Natural persons only. GDPR Recital 14 says the Regulation protects natural persons, whatever their nationality or place of residence. It does not cover data concerning legal persons, such as a company’s name, legal form and contact details. The line isn’t always where the business label suggests: data about a sole trader, or a firm named after the people behind it, can still identify a person.
Who the GDPR protects
Article 1 says the GDPR lays down rules on the protection of natural persons with regard to the processing of personal data, and Article 4(1) defines personal data as information relating to an identified or identifiable natural person. Recital 14 states the consequence in both directions. Everyone who is a natural person is covered, wherever they come from or live. Data that concern a legal person as such are not.
The CJEU drew a similar line under the EU Charter of Fundamental Rights before the GDPR existed. In Volker und Markus Schecke and Eifert, it held that legal persons can claim the protection of Articles 7 and 8 of the Charter only in so far as their official title identifies one or more natural persons (para 53). A farming partnership named after its two partners qualified (para 54). It also held that it makes no difference that published data concern professional activities (para 59).
On nationality, the Court held in Weltimmo that the Hungarian nationality of property owners was of no relevance to deciding which national law applied to processing their data (para 40). Under the GDPR, whether the Regulation applies depends on Article 3, which looks at where the controller is established or whether people in the Union are targeted or monitored, not at their passports.
A business record can still be a person’s record
Poland’s data protection authority fined a business information company that took sole traders’ names, business names and registered addresses from public registers without telling them. Those records concerned natural persons, so Article 14 applied, as the Bisnode case shows.
Recital 14 sentence by sentence
| Recital 14 says | Binding provision | Case law |
|---|---|---|
| (1) Protection applies to natural persons, whatever their nationality or place of residence | Art. 1(1) and (2); Art. 4(1); territorial scope in Art. 3 | CJEU C-230/14, Weltimmo: nationality of the people concerned is irrelevant to the applicable law |
| (2) Data concerning legal persons, including their name, legal form and contact details, are not covered | No Article says this expressly; it follows from “natural person” in Art. 4(1) | CJEU C-92/09 and C-93/09: a legal person’s name is protected only where it identifies natural persons; UODO, Bisnode: sole traders’ business data treated as personal data |
Numbers in brackets refer to the sentences of Recital 14 as numbered above. Schecke and Weltimmo were decided before the GDPR, under the Charter and Directive 95/46/EC.
What this means in practice
Yes
It is personal data. The GDPR applies in full, including the duty to inform people whose data you did not collect from them (Art. 14)
No
Recital 14 applies: the GDPR does not cover it
If you build or buy B2B databases
Records taken from business registers can be personal data if the business is one person.
- The UODO treated sole traders’ names, business names, registered addresses and activity codes as personal data (decision ZSPR.421.3.2018).
- Publishing a privacy notice on your website was not enough where the company held postal addresses and could write to people directly.
- The authority saw it differently for company shareholders and board members, whose contact details are not in the court register, so finding them could be a disproportionate effort.
If your customers are companies
The company is outside the GDPR; the people you deal with there may not be.
- A legal person’s name, legal form and contact details are not covered (Recital 14).
- Where the name of a firm identifies its partners, the CJEU treated it as protected data about those people (Schecke, paras 53–54).
- Information does not stop being personal because it is about someone’s work (Schecke, para 59).
Real Cases: Where Business Data Still Names a Person
The cases below show where the line in Recital 14 falls in practice: a database of sole traders built from public registers, a partnership named after its partners, and a property website whose owners’ nationality didn’t matter. Schecke and Bisnode are covered in full here; Weltimmo is documented under Recital 22.
| Company | Authority & date | Fine | What happened |
|---|---|---|---|
| Bisnode Polska | UODO (Poland), Mar 2019 | PLN 943.470 (€220.000) | Failed to give Article 14 information to people running sole-trader businesses whose data it took from public registers; the courts upheld the duty for active and suspended businesses but annulled the fine, which the UODO must reconsider |
| Volker und Markus Schecke and Eifert (C-92/09 and C-93/09) | CJEU, Nov 2010 | No fine | EU rules published the names and aid amounts of all farm-aid recipients; invalid for natural persons, valid for legal persons, which are protected only where their name identifies people |
| Weltimmo (C-230/14) | CJEU, Oct 2015 | No fine | The CJEU held that the nationality of the people whose data were processed was irrelevant to the applicable law. Documented under Recital 22 |
See all Recital 14 enforcement cases →
Frequently asked questions
Does the GDPR protect information about companies?
Not information that concerns a legal person as such. Recital 14 says the GDPR does not cover the processing of data concerning legal persons, in particular undertakings established as legal persons, including their name, legal form and contact details.
Is a sole trader’s business data personal data?
In the Bisnode case the Polish authority treated the business name, registered address and activity code of people running sole-trader businesses as their personal data, and required the company to give them Article 14 information. The courts upheld that obligation for people who were still trading or had suspended their business.
Can a company name be personal data?
It can identify people. In Volker und Markus Schecke the CJEU held that legal persons can claim the protection of Articles 7 and 8 of the Charter only in so far as their official title identifies one or more natural persons, as a partnership named after its partners did.
Does the GDPR protect people who are not EU citizens?
Yes. Recital 14 says the protection applies to natural persons whatever their nationality or place of residence. Whether the GDPR applies to a given processing operation depends on Article 3, not on the nationality of the people concerned.
Is information about someone’s work excluded because it is professional?
No. In Schecke the CJEU held that it is of no relevance that published data concern activities of a professional nature, because the notion of private life is not to be interpreted restrictively.
Do you know which of your business records identify people?
Supplier lists, CRM records and prospect databases often mix company data with data about sole traders and named contacts. Knowing which is which tells you where the GDPR’s duties apply.
Related provisions
Sources & further reading
- Regulation (EU) 2016/679 (GDPR), Recital 14, Articles 1, 3, 4 and 14: official text
- CJEU, Joined Cases C-92/09 and C-93/09, Volker und Markus Schecke and Eifert, judgment of 9 November 2010
- President of the Personal Data Protection Office (UODO), decision ZSPR.421.3.2018 of 15 March 2019 (Polish)
- UODO, The Supreme Administrative Court upheld the decision of the Personal Data Protection Office, 20 September 2023
- CJEU, Case C-230/14, Weltimmo, judgment of 1 October 2015