Does GDPR apply to businesses outside the EU?
Short answer
It can. The GDPR applies to organizations established in the EU, and also to organizations elsewhere that offer goods or services to people in the EU or monitor their behavior there. If you sell to or track visitors in the EU, read the regulation’s territorial scope carefully or get legal advice.
The details
Security is part of GDPR compliance: Article 32 requires appropriate technical and organizational measures, and Article 33 sets breach notification duties.
Useful next reads and tools
Terms explained
- GDPR
- The General Data Protection Regulation (GDPR) is the European Union’s law on the processing of personal data, including security and breach notification duties.
Sources
Related questions
Related Guides
GuideGRC
10 Steps to Implement ISO 27001 and Get Certified
A step-by-step ISO/IEC 27001:2022 implementation plan: scope, leadership, risk assessment, Statement of Applicability, Annex A controls, internal audit, management review and the certification audit.
Read more GuideGRC
NIST AI RMF: Implementation Guide for Small Teams
Learn how small teams can implement the NIST AI RMF to assess risk, govern deployments, and deploy artificial intelligence safely without enterprise overhead.
Read more GuideGRC
How to Create an Acceptable Use Policy for Employees
Learn how to create an acceptable use policy for employees. This step-by-step tutorial covers scope, permitted use, prohibited actions, and enforcement.
Read more GuideGRC
How to Write a Data Retention Policy: A Step-by-Step Guide
Learn how to write a data retention policy that aligns with GDPR and the NIST Privacy Framework. Define schedules, disposal rules, and audit controls.
Read more