Does GDPR apply to businesses located outside the European Union?

Yes. The General Data Protection Regulation applies extraterritorially. Any organization that offers goods or services to individuals located within the European Union, or monitors their behavior online, must comply with the framework regardless of the physical location of the business headquarters or servers.

What is a data subject access request under GDPR?

A data subject access request is a formal submission by an individual asking an organization to confirm whether their personal data is processed and to provide a copy of that information. Organizations must verify the requestor identity and fulfill the request within one calendar month without charging a fee.

What constitutes a lawful basis for data processing?

The General Data Protection Regulation outlines six valid legal grounds for processing personal data: explicit user consent, performance of a contract, compliance with a legal obligation, protection of vital interests, tasks carried out in the public interest, or legitimate commercial interests balanced against individual privacy rights.

Security & Privacy

GDPR

The General Data Protection Regulation is a European Union law governing how organizations collect, store, and process the personal data of individuals.

also called: General Data Protection Regulation

// definition

The General Data Protection Regulation (GDPR) is a comprehensive data privacy law enacted by the European Union (EU) that took effect in May 2018. It establishes legal requirements for collecting, processing, storing, and transferring the personal data of individuals located within the European Economic Area, regardless of where the processing organization is headquartered. Personal data encompasses any information that directly or indirectly identifies an individual, including names, email addresses, location data, and online identifiers.

Under the regulation, organizations must establish a lawful basis for data processing, maintain data minimization practices, and ensure data security through appropriate technical and organizational measures. It grants individuals specific rights over their personal information, such as the right to access, correct, delete, and transfer their data.

// why it matters

Compliance with the General Data Protection Regulation is critical for any organization operating a website or software platform that serves European users. Non-compliance can result in substantial administrative fines reaching up to twenty million euros or four percent of global annual turnover, whichever is higher. Beyond financial penalties, adherence requires businesses to implement clear consent mechanisms, enforce strict access controls, maintain audit logs, and establish processes for handling data subject access requests. Integrating these privacy standards into product design reduces legal liability, prevents security breaches, and ensures operational continuity across global markets.

// example

An e-commerce company based in North America deploys a web application accessible to customers worldwide. When an individual from Germany creates an account, the platform displays an explicit consent banner for tracking cookies, provides an opt-in checkbox for marketing emails, and encrypts stored user profiles. If the customer requests the deletion of their account, the application automatically purges their personal details from production databases and logs the fulfillment of the request for auditing purposes.

Questions and Answers

Does GDPR apply to businesses located outside the European Union?: Yes. The General Data Protection Regulation applies extraterritorially. Any organization that offers goods or services to individuals located within the European Union, or monitors their behavior online, must comply with the framework regardless of the physical location of the business headquarters or servers.
What is a data subject access request under GDPR?: A data subject access request is a formal submission by an individual asking an organization to confirm whether their personal data is processed and to provide a copy of that information. Organizations must verify the requestor identity and fulfill the request within one calendar month without charging a fee.
What constitutes a lawful basis for data processing?: The General Data Protection Regulation outlines six valid legal grounds for processing personal data: explicit user consent, performance of a contract, compliance with a legal obligation, protection of vital interests, tasks carried out in the public interest, or legitimate commercial interests balanced against individual privacy rights.