Situation: Parent company is registered in the EU member state but does not do b2c business in the EU and does not process personal data of Europeans. Subsidiaries are not EU companies and does not do b2c business in the EU and does not process personal data of europeans. Is it true that the parent company must comply with the GDPR just because it is registred in the EU (even if does not really do business in the EU)?

  • No, it only has to do with personal data of EU citizens, regardless where the company is registered. However, you say you have no EU consumers but be advised that an EU employee is also a person which has personal data under GDPR jurisdiction.
    – Per Digre
    May 23, 2018 at 7:57
  • @PerDigre correction: it has to do with personal data of EU residents. An EU citizen who is not in the EU has no more protection than a non-EU citizen who is not in the EU, and a non-EU citizen who is in the EU is fully protected.
    – phoog
    Sep 21, 2018 at 15:13
  • @phoog, I tend to disagree, GDPR protects EU citizens regardless where they live. See the discussion in this article medium.com/@thomasyohannan/…
    – Per Digre
    Sep 22, 2018 at 19:11
  • @PerDigre a person in the EU can claim GDPR protection against a company with no EU presence, although the EU's ability to enforce anything in such a case is limited. A person outside the EU has no claim to GDPR protection against such a company, regardless of citizenship. The discussion you link to cites a text with no legal force in support of its claim that all EU citizens are protected. The text of the GDPR makes no such claim.
    – phoog
    Sep 22, 2018 at 22:57
  • @phoog, you are right. GDPR itself just states persons in the EU, which is sort of open to interpretation, but you will see EU citizens mentioned occasionally. On the point of enforcement, I am still waiting to see EU try to enforce companies outside of EU, which is techically possible if they make money from europe. I am thinking of the chinese companies like Alibaba, Tencents etc which surely ignores GDPR.
    – Per Digre
    Sep 23, 2018 at 7:45

1 Answer 1


Yes the parent company does need to comply with GDPR

To quote the UK information commissioner:

The GDPR applies to processing carried out by organisations operating within the EU. It also applies to organisations outside the EU that offer goods or services to individuals in the EU.


And from the regulation itself:

Any processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union should be carried out in accordance with this Regulation, regardless of whether the processing itself takes place within the Union


(Point 22)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .