The European Regulation for Non-EU Countries: How the GDPR Really Works

When people hear about the GDPR, many automatically assume that it is a law that applies exclusively within the European Union. In reality, this is one of the most common misconceptions.

Although the GDPR is an EU regulation, its scope has long extended beyond companies established within the European Union. The Regulation may also apply to businesses based in the United States, the United Kingdom, Canada, Ukraine, Japan, Australia, and virtually any other country, provided that the conditions set out in Article 3 of the GDPR are met. The reason is simple: in today's digital world, personal data does not stop at national borders.

1. «It Is Not About Where a Company Is Registered, but Where It Operates»-

When determining whether the GDPR applies, the decisive factor is not where a company is incorporated, but the geographical scope of its activities. If a company offers goods or services to individuals located in the EU or monitors their behaviour, it may fall within the scope of the GDPR regardless of where it is registered.

This most commonly occurs in two situations.

The first is where a company intentionally offers goods or services to individuals in the European Union. For example, a Ukrainian SaaS provider enters into contracts with customers in Germany, or a U.S.-based online retailer ships products to France.

The second is where a company monitors the behaviour of individuals in the EU. The use of cookies, web analytics, advertising pixels, or similar technologies to analyse the behaviour of users located in the European Union may also trigger the application of the GDPR.

2. Transfers of Personal Data Outside the European Union

Another important situation in which non-EU countries interact with the GDPR concerns international transfers of personal data.

Where an organisation established in the European Union transfers personal data to a third country, such transfer must comply with the GDPR. The Regulation provides several legal mechanisms to ensure an adequate level of data protection.

• Adequacy Decision. Where the European Commission has recognised that a third country ensures an adequate level of data protection, personal data may be transferred without additional contractual safeguards. Countries benefiting from an adequacy decision include the United Kingdom, Japan, South Korea, Switzerland, New Zealand, and several others.

• Alternative transfer mechanisms. Where no adequacy decision exists, organisations typically rely on other safeguards, most notably the Standard Contractual Clauses (SCCs) or, in the case of multinational groups, Binding Corporate Rules (BCRs).

It is important to understand that the GDPR does not prohibit international transfers of personal data. Rather, it requires that the data continue to receive a level of protection essentially equivalent to that guaranteed within the European Union. This is precisely why mechanisms such as Adequacy Decisions, Standard Contractual Clauses (SCCs), and other safeguards provided under Chapter V of the GDPR exist.

3. Is an EU Representative Required?

In many cases, a company established outside the European Union but subject to the GDPR must appoint a representative within one of the EU Member States.

Such a representative is not a branch office or subsidiary. Instead, the representative serves as the company's point of contact with European supervisory authorities and data subjects regarding compliance with the GDPR. At the same time, the Regulation provides several exceptions where appointing an EU representative is not required.

Practical Examples