local presence of a company or Data Controller
It doesn't matter if your company (or other data controller) is in the UK or EU. It matters if the data subject is in it, and that you offer any service in the EU - even if it is your website. Now it can matter what kind of service you offer, but in general, the moment you control data from the area and offer service to it, you made yourself subject to GDPR by controlling their data.
The GDPR applies to:
- a company established outside the EU and is offering goods/services (paid or for free) or is monitoring the behaviour of individuals in the EU.
Now, we have a local branch office... and that makes it guaranteed applicable:
The GDPR applies to:
- a company or entity which processes personal data as part of the activities of one of its branches established in the EU, regardless of where the data is processed;
Countries can only be sued if they allow it
Now it gets wonky: nowhere in the GDPR or UK-GDPR there is any mention of countries. Why? Because countries can't legislate other countries. If Datatistan offers a service to EU citizens, it can't be prosecuted by a GDPR country if they mess with the data in noncompliant ways, as states can't prosecute other states in their own justice system. That's not diplomatic immunity, it's part of the customary Sovereign Immunity. In other words: nobody can sue or prosecute a foreign state unless they agree to it.
The consulate or embassy is an arm of the state. Its officers, the consul, the ambassador, and many employees are covered by Diplomatic Immunity and can't be effectively prosecuted either. And then there's the problem that on the grounds of the embassy (but not the consulate) the host state can't enforce its own laws without the ambassador allowing it.
It's incredibly hard to sue states - and so far the only political institution sued under GDPR is the European Commission itself in July of 2022 - though that case isn't even out of the preliminary phase that establishes it can even be sued under GDPR, and it's not a country in its own. Against a non-GDPR country... what venue do you want to use? The EUCJ can't adjudicate a foreign non-GDPR state because it is out of the jurisdiction to be sued there. The Country that is non-GDPR doesn't have the GDPR that would allow you to sue the country.
Many uses for PII of a country are exempt anyway
§2 This Regulation does not apply to the processing of personal data:
(a) in the course of an activity which falls outside the scope of Union law;
(d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.
A foreign country doing foreign intelligence or even any other use of PII under its own laws is wholly encompassed under (a) and using it for crime prevention is under (d) anyway. Which includes for example handling and issuing of travel documents for public security grounds.