EUGDPRGDPR PrinciplesEASYFree question
A US-based company selling products to EU customers must comply with GDPR. This is due to:
- A.The company having EU employees, citing Article 3(2), which limits the territorial scope to controllers holding an establishment in a member state
- B.A bilateral trade agreement, under Article 3(1), which limits territorial scope to controllers with a main establishment physically located inside the EU
- C.GDPR's extraterritorial scope under Article 3
- D.US federal data protection law
Why C is correct
Article 3 of GDPR establishes its extraterritorial scope, applying to organizations outside the EU that offer goods or services to, or monitor behavior of, EU data subjects.
Know someone studying for GDPR? Send them this one.