Does the GDPR apply to a company established outside the EU?

• EU

  Article 3(2) catches offering goods or services to people in the Union and monitoring their behaviour in the Union, whatever the place of establishment. Article 27 then requires a written representative in a member state where those people are.

  Regulation (EU) 2016/679 · Europeiska unionens publikationsbyrå

• United States

  A US company with EU customers is inside the GDPR and inside its own state laws at the same time. The two do not replace each other, and California thresholds are counted separately.

  Cal. Civ. Code § 1798.100 · California Legislative Counsel

• Sweden

  The representative may sit in Sweden when the people addressed are here, and the Authority for Privacy Protection then supervises through that representative.

  SFS 2018:218 · Sveriges riksdag

• Norway

  Norway is inside the EEA, so the same test applies and a representative may sit in Norway for the Norwegian public.

  LOV-2018-06-15-38 · Lovdata

• Germany

  German supervision is at state level, so the representative's address decides which state authority handles the case.

  BDSG 2018 · Bundesministerium der Justiz

• Article 3(1): processing in the context of an establishment in the Union, wherever the processing happens.
• Article 3(2): offering goods or services to, or monitoring the behaviour of, people in the Union.
• Article 27: a written representative in the Union unless the processing is occasional and low risk.

Decide the question per audience, not per office. A language, a currency and a delivery country in the checkout are the facts a supervisory authority reads as offering goods to the Union.

You keep your rights against a company with no EU office, and the representative named in the privacy notice is a valid address for your request.

Read the representative rule together with the transfer rules, because a company caught by Article 3 usually needs a transfer basis as well.

All global questions