Key points
- Since 2018, the GDPR has been an essential framework for anyone handling personal data of residents of the European Union.
- Its territorial scope is broad: it applies to organisations established in the EU, whatever their size, and to those that target or monitor individuals located there.
- A company established outside the EU is subject to it if it targets the European market or monitors the behaviour of its residents.
- Two applicability criteria: having an establishment in the EU, or targeting European residents through goods, services or online monitoring.
- The Regulation distinguishes the controller, which determines the purposes and means, from the processor, which acts on behalf of another organisation.
- It applies regardless of size or status, from large groups to micro-enterprises and SMEs (TPE/PME), as well as associations and public bodies.
Since 2018, the General Data Protection Regulation (GDPR) has been an essential legal framework for everyone who handles personal data. Its main aim is to ensure that the collection, processing and use of personal information respect individuals’ fundamental rights, in particular those of residents of the European Union. But who actually has to comply with these requirements? The answer goes well beyond large companies; it covers a wide range of public and private organisations, whatever their size or activity, as soon as they are involved in processing personal data.
What is the territorial scope of the GDPR?
The territorial scope of the GDPR is particularly broad. It is not limited to the geographical borders of the European Union: any organisation established in the Union is concerned, whatever its size or sector, and an organisation established outside the Union is also concerned when it processes data relating to individuals located in the EU in order to offer them goods or services or to monitor their behaviour (Article 3 of the GDPR). This covers both controllers and processors, including certain organisations based outside Europe that offer goods or services to individuals located in the Union, whatever their nationality.
A company established outside the EU can therefore be subject to the GDPR if it targets the European market or monitors the behaviour of its residents. This rule has a direct impact on international data flows and profoundly changes how transfers of personal data are managed worldwide.
Does the GDPR apply to non-EU companies? The territorial criteria
To determine whether the GDPR applies to an entity, two main criteria must be examined. First: any public or private organisation with a presence (head office, branch or subsidiary) in the European Union that processes personal data in that context is automatically concerned. Second: even without a presence in the EU, an organisation falls within the scope of the GDPR if it specifically targets European residents by providing goods or services or by monitoring their online behaviour.
This extraterritorial reach therefore requires foreign companies to be particularly vigilant when they collect, store or use data of individuals in Europe. Overlooking this dimension exposes them to significant financial penalties and to a loss of trust among partners. To ensure compliance, it is often worth calling on a GDPR lawyer to make each stage of personal data processing legally sound.
Practical examples of the territorial criterion
For example, a US-based e-commerce site that offers delivery to France or Belgium is subject to the GDPR. Likewise, a Canadian organisation that analyses the browsing habits of European visitors must comply with all the obligations applicable to the collection, storage and analysis of the personal data of these individuals.
The same applies to technical service providers established outside the Union that host, back up or analyse databases containing information relating to residents of the European Union, where this processing is related to offering goods or services to these individuals or to monitoring their behaviour. All these cases illustrate the extraterritorial reach of the Regulation.
Which types of organisations does the GDPR apply to?
The legislation mainly distinguishes two categories of players: controllers and processors. The controller determines the purposes and means of the collection and use of personal data, while the processor acts on behalf of another organisation in carrying out these operations.
The GDPR applies regardless of size or status. From large international groups to local micro-enterprises and SMEs, including volunteer associations, any organisation that carries out processing of personal data must ensure it complies.
Public and private organisations
All government departments – local, regional or national – must apply the GDPR rules scrupulously. Educational institutions, hospitals, consular chambers (chambres consulaires: chambers of commerce, trades and agriculture) and local authorities that manage files on the population, staff or service users are also concerned.
In the private sector, a wide variety of players is involved: industrial companies, banks, insurance companies, estate agencies, marketing companies, sports federations, online retailers and craftspeople.
Micro-enterprises, SMEs, associations and liberal professions
The small size of an organisation never exempts it from its obligations. A simple sports association collecting its members’ contact details, or a medical practice computerising its appointments, must apply the data minimisation principle and keep files secure.
Liberal professions such as lawyers, commissaires de justice (judicial officers), chartered accountants and doctors are fully subject to the confidentiality and security requirements imposed by the GDPR.
Processors and external partners
More and more often, controllers delegate certain tasks to external partners: storage, backup, sending newsletters, and so on. Processors must then show that they have a rigorous confidentiality policy, formalise their engagement in a contract and allow the client to verify their guarantees, in particular in the event of an inspection.
Here is a summary list of the main categories concerned:
- Government departments and local authorities
- Companies of all sizes (including micro-enterprises and SMEs)
- Associations, trade unions, federations
- Technical service providers carrying out delegated processing
- Healthcare professionals and liberal professions
What does “processing of personal data” cover?
Any information that makes it possible to identify a natural person directly or indirectly falls within the scope of the GDPR. The notion of personal data is very broad: name, postal address, email address, telephone number, online identifier, photo, biometric data, opinion, affiliation or browsing habits, and so on.
As for processing, it covers not only the initial collection but any operation performed on the data: organisation, structuring, storage, consultation, transfer, alteration or erasure. Any action on these elements falls under the GDPR, whatever the medium or technology used.
Storage and use of personal data
Storage means recording or keeping the information, in digital or paper form. Use covers any concrete use of the data: making contact, analysis, segmentation, service personalisation or marketing campaigns.
Article 4(2) of the GDPR gives a non-exhaustive list of the operations that constitute processing of personal data. Here is a summary table to help you understand:
| Category | Practical example |
|---|---|
| Collection | Sign-up form on a website |
| Storage | Recording in a CRM or a file |
| Use | Statistical analysis of customer purchases |
| Disclosure | Sharing employee data with an external service provider |
| Destruction | Permanent erasure of obsolete data |
This table shows that each stage in the life of a piece of data engages the responsibility of the organisation that handles it.
What special cases or exceptions are provided for?
Some situations fall wholly or partly outside the GDPR rules. This is the case for purely personal or household processing: managing a family address book or exchanges on social networks within a small circle, as long as there is no public disclosure or commercial use.
There are other examples: processing by competent authorities in criminal matters is subject to a separate regime, and activities that fall outside the scope of EU law, such as national security, are outside the GDPR. Courts remain subject to the Regulation, but the supervisory authority is not competent to supervise their processing operations when they are acting in their judicial capacity. Processing for journalistic purposes also benefits from exemptions provided for by each Member State in the name of freedom of expression and information.
Detailed FAQ on the GDPR obligations of different organisations
How do you know whether a small business must apply the GDPR?
Most micro-enterprises and SMEs are concerned as soon as they collect, store or use data about prospects, employees or customers in Europe. For example, keeping a contact list is enough to make the GDPR applicable. Some typical situations:
- Internal management of staff or commercial emails
- Collecting customer or prospect records
- Using digital tools hosted outside the EU that process data of European residents
What are the risks for an association that neglects the GDPR rules?
Associations, like companies, are liable to administrative penalties in the form of fines whose amount varies according to the seriousness of the infringement:
| Type of infringement | Potential amount |
|---|---|
| Breaches of the controller’s or processor’s obligations (no record, insufficient security) | Up to €10 million or 2% of total worldwide annual turnover |
| Breach of the principles or of data subjects’ rights (collection without a legal basis, failure to inform) | Up to €20 million or 4% of total worldwide annual turnover, whichever is higher |
Which organisations are exempt from the GDPR?
Some processing falls outside the GDPR, mainly in the following cases:
- Purely personal or household processing
- Activities that fall outside the scope of EU law, such as national security
- Processing by competent authorities in criminal matters (prevention, investigation, prosecution)
How does the GDPR change the role of processors?
Today, processors have direct legal obligations: implementing appropriate security measures, notifying incidents and keeping a record of the activities carried out for their clients. Their relationship with the controller is strictly governed by a contract, which includes:
- Precise description of the processing entrusted
- Provision of procedures enabling data subjects to exercise their rights
- Possibility of carrying out internal or external audits
