- GDPR may also apply to companies outside the EU that target individuals in the EU or monitor their behavior, provided the conditions of the regulation are met.
- The data controller and the processor have different roles; suppliers must be assessed based on the actual relationship.
- Transferring data outside the EEA requires a separate assessment of the appropriate mechanism and conditions.
- Cross-border processing and the lead authority have specific definitions and do not solely depend on the number of countries involved.
How to organize customer data from multiple countries, check supplier roles, the appropriate authority, and data transfers outside the European Economic Area.
Status checked: November 2, 2026. We are not a law firm. The text is for informational and educational purposes and does not constitute individual legal advice. Before making decisions, check the regulations applicable to your location and type of business and consult with a lawyer or other appropriate specialist.
When GDPR May Apply to a Company
The regulation applies, among other things, to the processing of data in connection with the activities of an organizational unit in the EU, regardless of where the processing itself takes place. It may also cover certain actions of a company outside the EU that offers goods or services to individuals in the EU or monitors their behavior in that area. The mere fact that a site is technically accessible from another country should not be the only basis for assessing the targeting of the offer.
Check the sales model, languages, markets, currencies, delivery, and marketing activities. Depending on the situation, there may be additional obligations regarding a representative in the EU. A company operating in the UK should also separately assess UK regulations.
Data Mapping and Supplier Roles
Outline the data flow from the order form through payment, delivery, accounting, and complaint handling to deletion or archiving. For each purpose, determine the scope of data, legal basis, retention period, and individuals with access. Information for customers should correspond to actual processes and be understandable to recipients.
The data controller determines the purposes and methods of processing, while the processor acts on their behalf. When a supplier is a processor, Article 28 of GDPR requires an appropriate contract or other legal act that meets the conditions of the regulation. Not every data recipient is a processor; roles must be established based on the actual relationship.
Supervisory Authority in Cross-Border Activities
The mechanism of the lead authority is significant for cross-border processing in the sense of GDPR. The EDPB explains that when determining the lead authority, factors such as the location of the main establishment and the place where decisions regarding the purposes and means of processing are made are essential. It is not sufficient to indicate the country where the company has the most clients.
The lead authority collaborates with other concerned authorities. Jurisdiction in a specific case requires an assessment of the company's structure and the nature of the processing. An enterprise without a unit in the EEA should not assume that the mechanism operates identically to a company with a main establishment in the EEA.
Transfer Outside the EEA and Breaches
A cloud or technical support provider may access data from a country outside the EEA. Determine whether a transfer occurs under the regulations, to whom, and on what basis. A decision confirming the appropriate level of protection or adequate safeguards may be required, along with further assessment of the circumstances. Simply indicating the server address does not always resolve access and transfers.
In the event of a security breach, document the incident, assess the risk to individuals, and check whether notification to the authority or informing individuals is required. The EDPB also clarifies that the processor should notify the controller of a breach without undue delay. In cross-border processing, check the appropriate authority.
Example: Selling in Several Countries
A store based in Poland sells in several EU countries and uses a mail provider outside the EEA. The owner should not limit themselves to a single privacy policy. First, they establish the purposes and roles of the entities, then check the supplier's documents, any potential transfers, the appropriate authority, and how to handle customer requests.
How to Check a Supplier Before Signing a Contract
Ask the supplier for a description of services, subcontractors, processing locations, and service access. Check whether they process data solely on the company's instructions or if they determine purposes for some activities themselves. One service may involve different roles for different processes, so a label in the contract is not sufficient.
Read the security, data deletion, assistance with requests and breaches, and subcontractor change conditions. If data is transferred outside the EEA or accessed from there, determine the transfer mechanism and documents needed in the specific situation.
After the collaboration ends, check what happens to the data in the active system and copies, when they will be returned or deleted, and whether there is an obligation to retain certain information. Record the responsible person and the control deadline.
Frequently Asked Questions
Does GDPR apply only to companies based in the EU?
No. In certain situations, it also covers entities outside the EU, for example, those targeting individuals in the EU.
Does every foreign supplier automatically mean unlawful transfer?
No. It is necessary to determine whether a transfer occurs, what mechanisms and conditions apply, and what safeguards have been provided.
Related Guides
Sources
| Document | What it Contains |
|---|---|
| European Commission: Application of GDPR | Territorial scope and entities covered by the regulations. |
| EDPB: Data Protection Authority | Cross-border processing and lead authority. |
| EDPB: International Transfers | Conditions for transferring data outside the EEA. |
| EDPB: Data Breaches | Assessment of breaches and notifications. |
Comments (0)
No comments yet. Be the first!