Widen Scope

  • Expanded territorial scope
    • Establishments in the EU
      • Real exercise of activity more than Establishments’ legal form
    • Establishments outside the EU
      • Subject to GDPR if it processes personal data:
        • of data subjects who are in the Union (includes residing even if not EU citizens) +
        • the processing relates to:
          • offering of goods or services (payment is not required) or
          • monitoring of their behaviour (behaviour taking place in EU)
    • Representative might be required
  • Extensive definitions of personal data
    • Any information relating to an identified or identifiable natural person
    • identifiable […] directly or indirectly (in particular through an identifier)