Widen Scope

• Expanded territorial scope
  • Establishments in the EU
    • Real exercise of activity more than Establishments’ legal form
  • Establishments outside the EU
    • Subject to GDPR if it processes personal data:
      • of data subjects who are in the Union (includes residing even if not EU citizens) +
      • the processing relates to:
        • offering of goods or services (payment is not required) or
        • monitoring of their behaviour (behaviour taking place in EU)
  • Representative might be required
• Extensive definitions of personal data
  • Any information relating to an identified or identifiable natural person
  • identifiable […] directly or indirectly (in particular through an identifier)