General Data Protection Regulation (GDPR)
What this domain tests
This domain tests the Regulation's reach and the operational duties that follow: scope, rights, accountability tools, breach handling and transfers.
Scope
Article 3 applies to processing by an EU/EEA establishment, and to non-EU controllers or processors that offer goods or services to people in the EU or monitor their behaviour. Offering is assessed by targeting indicators, not by the mere accessibility of a website. A non-EU controller caught by Article 3(2) must generally appoint an Article 27 representative.
Rights and duties
Data subjects have rights of access, rectification, erasure, restriction, portability and objection (Articles 15-21), answered within one month, extendable by two for complex requests. Controllers must keep Article 30 records, run DPIAs for high-risk processing (Article 35), appoint a DPO where Article 37 applies, and notify personal data breaches to the supervisory authority within 72 hours of awareness unless unlikely to result in risk (Article 33).
Worked example
A US analytics firm with no EU office tracks EU visitors' browsing and sends reports to clients. Tracking behaviour brings it within Article 3(2)(b). Its EU representative is the Article 27 contact, but the firm remains controller and accountable. If a breach occurs, it notifies the supervisory authority within 72 hours of becoming aware, describing the nature, likely consequences and measures taken. A processor would instead notify its controller without undue delay (Article 33(2)).
Traps
- Equating "no EU establishment" with "GDPR does not apply".
- Treating the 72-hour clock as starting at the incident rather than at awareness.
- Confusing processor breach notification with controller notification.
- Assuming a DPO is mandatory for every organisation.