2

I work for an EU company based in the UK and often work with clients in China and Africa (and some other non-EU countries). In the future, it may arise that we will be storing some personal information on citizens from these countries and was wondering what the GDPR laws were with reference to an EU company storing non-EU citizen data?

I thought GDPR was to protect the data/information of EU citizens (from Wikipedia):

General Data Protection Regulation (EU) 2016/679 ("GDPR") is a regulation in EU law on data protection and privacy for all individuals within the European Union (EU) and the European Economic Area (EEA).

but wasn't sure if personal information outside of the EU was also protected.

Short version: are there any GDPR considerations that must be in place when an EU company stores personal information from citizens outside of the EU?

  • The Wikipedia text you quote does not mention citizenship (and neither does the GDPR). – phoog Sep 27 '18 at 16:59
  • OK - perhaps 'resident' is a more appropriate term – tda Sep 28 '18 at 7:07
2

are there any GDPR considerations that must be in place when an EU company stores personal information from citizens outside of the EU?

Absolutely. The territorial scope of the GDPR is specified at Article 3:

Article 3

Territorial scope

  1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.

  2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

    (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

    (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

  3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.

As specified in point 1, the regulation applies to controllers and processors located in the EU. There is no exemption of personal data based on the data subject's nationality or location.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.