Does running an unregistered business make you subject to GDPR?

ANSWER

In the case described of running an unregistered business, where it may be necessary to process personal data of customers (e.g., name and surname, telephone number, e-mail address, or personal data of employees, contractors, or other counterparties), the individual running such an unregistered business will be considered a personal data controller within the meaning of Art. 4(7) GDPR, i.e., an entity that determines the purposes and means of processing personal data. They will therefore be subject to GDPR provisions, including, pursuant to Art. 24(1) and (2) GDPR – implementing appropriate technical and organisational measures, as well as personal data protection policies.