Data protection law does not apply to the processing of personal data where the personal data is kept by an individual and is concerned solely with the management of his/her personal, family or household affairs or kept by an individual for recreational purposes (Article 2(2)(c) of the General Data Protection Regulation (GDPR)). This applies as long as the personal data is not used in connection with a professional or commercial activity or made publicly available.

For further information on this topic, please see the following guidance on this topic:

• Taking photos at a school event – where common sense comes into play
• Does the GDPR really say that? Festive edition
• CCTV in the home