I have a question regarding The General Data Protection Regulation 2016/679 in European law and I'm not even sure this is the right place to ask, but I'll ask anyway as I'm stuck on where to find this information.

I work for a company that controls several different websites under one legal entity and we currently serve newsletters to each website asking for consent in each case (per domain), however, we're looking at consolidating them under our overall company identity and confused as to whether or not we can requeset permission from one domain e.g. websiteone.com and serve them content from another e.g. websitetwo.com even though they operate under the same company.

  • To what extent are the existing websites distinct? Do they appear to be separate businesses doing different things? Or is the underlying company pretty visible already (e.g. "Welcome to foo.com, operated by Bar Ltd" on a masthead)? What do your existing privacy policies say? – Paul Johnson Oct 5 '19 at 16:15
  • I believe the bit of knowledge you're missing is that websites/domains aren't legal entities. The company is the only legal entity in your question. The data controller is the company. Websites can't be legal entities (and therefore can't be data controllers). I suggest you consult the Big G with the search term "separate legal entity". – lellis Oct 7 '19 at 17:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.