Many provisions of the GDPR refer to the rights and freedoms of “natural persons” that would be protected. Central provision is certainly Art. 1 I GDPR:

“This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.”

Even more refer to the rights and freedoms of “data subjects”. It is therefore clear that “natural persons” primarily means “data subjects” [definition in Art. 4 No. 1 GDPR].

The reference to “natural persons” also makes clear that the rights of legal persons are not protected insofar as they are affected by data processing.

“Natural persons” can, however, also be “controllers” and “third parties” within the meaning of the GDPR, as well as other natural persons [Tile CO.02].

The GDPR does not explicitly state which “rights and freedoms” are meant. Which “rights and freedoms” actually are protected is therefore highly controversial and unclear [Tile R.01].

Listed below are the 12 provisions in articles and 24 provisions in recitals that relate to the rights and freedoms of “natural persons”:

Articles: 1 I/II; 24 I; 25 I; 27 II a; 32 I; 33 I; 34 I; 35 I; 51 I; 57 I c; 70 I h GDPR.

Recitals: 2 (1); 3; 9 (1); 10 (1)/(2); 53 (3); 54 (2); 74 (3); 75; 77 (2); 78 (1); 80 (1); 84 (1); 85 (2); 86 (1); 89 (3); 94 (1)/(5); 98 (2); 113 (2); 116 (1); 154 (6); 166 (1); 173 (1) GDPR