Is EU GDPR applicable to Middle East companies

Answer:

The key to understanding when EU GDPR is applicable is understanding the meaning of “in the Union”. The EU GDPR will only apply to personal data regarding individuals within the Union, while the nationality or habitual residence of those individuals is irrelevant.

When the data of EU citizens is processed outside of the EU by companies which are also outside the EU, then this is not considered to be “in the Union”. In your case the EU GDPR will not be applicable since the processing does not take place “in the Union”, nor is the individual “in the Union”.

To learn more about the EU GDPR check out our free “EU GDPR Foundations Course”( https://advisera.com/training/eu-gdpr-foundations-course//)

Hi, I am not satisfied with the response specially once you have mentioed “in the Union”, nor is the individual “in the Union”. Could you please share which Act no you are refering here. Thanks.

Hi, I too not satisfied with the answer. Below two statement says GDPR is applicable to EU citizens outside of Europe. This is legislation basically on EU citizens data irrespective of geographic location. Please read the below support statements for your reference :

1. “Beyond the EU companies, the EU GDPR covers companies outside of the EU that offer goods or services to EU Data Subjects (“an identified or identifiable person to whom the ‘personal data’ relates”), even if for free, or that monitor the Data Subjects’ behavior within the EU”.

2. “The new GDPR will have a profound impact on all organizations that are responsible for processing and storing personal EU citizen data. And in today’s borderless digital world, this means businesses beyond Europe will be affected. Indeed, any business that deals with a partner in Europe will be subject to the rules.”

Answer:

I am sorry to hear that you are not satisfied with the interpretation of EU GDPR article 3 – Territorial Scope (https://advisera.com/eugdpracademy/gdpr/territorial-scope/). I would suggest you to carefully read through the article and you will find that one condition for the EU GDPR to be applicable is that the individual (data subject) needs to be “in the Union” (Union meaning the EU/EEA). If you have another interpretation please free to share it.

To make it more clear for you if there is a EU citizen coming to the Middle East and he/she wants to rent a car for example, the car rental company does not need to be compliant with the GDPR because the EU citizen is not physically present in the EU and the processing activity is also carried outside the EU.