This chapter looks at when the General Data Protection Regulation (GDPR) applies, rationae materiae, to biobanking—only when the law applies to biobanking can it be expected to provide any protection for genetic privacy rights in biobanking at all. The GDPR's applicability criteria are outlined in Article 2; criteria concern both the types of processing activity covered by the GDPR and the mechanics of processing covered by the GDPR. In relation to the mechanics of biobank processing, the situation is complex. The key question which emerges is which types of biobanking substances can qualify as personal data? The concept of personal data can be usefully broken down into two aspects of any processing operation. First, the substance being processed: to qualify as personal data, a substance must be able to fulfil three criteria. A substance must be ‘information’, it must ‘relate to’ a specific person, and that person must be a ‘natural person’. In the biobanking context, health, lifestyle, and biographical information, sequenced genomic data, and individual research results certainly fulfil these criteria. Second, the link between the substance and a specific individual: to qualify as personal data, a substance must relate to an individual who is ‘identified or identifiable’. All biobanking substances processed in either linked or pseudonymised form will certainly qualify as ‘identified or identifiable’.