1. I will like to know how to determine which supervisory authority I am under if I am an organization outside the EU but have reason to handle EU subject data from time to time. (What volume of EU subject data processing makes it rational for me to undertake GDPR compliance?)
Answer: Where the extra-territorial provisions of the EU GDPR apply, the controller or processor must appoint a representative. That representative must be based in a Member State in which the relevant individuals are based. There is a limited exemption to the obligation to appoint a representative where the processing is occasional, where it is unlikely to be a risk to individuals and it does not involve large scale processing of sensitive personal data.
2. The regulation appears rather vague on the data subjects, is it EU CITIZENS or EU residents?
Answer: The regulation is crystal clear and it refers to data subjects “in the Union”. The EU GDPR will only apply to personal data regarding individuals within the Union, while the nationality or habitual resi dence of those individuals is irrelevant. If you want to find out more about the EU GDPR, check out our free EU GDPR Foundations Course (https://training.advisera.com/se/eu-gdpr-foundations-course//).