3 ms·
As long as you don't target EU customers, you're fine.
by isostatic 8y ago
As long as you don't target EU customers, you're fine.
- sunsetMurk 8y agoDo you have any references/citations for this? Would help me out! I'm trying to put together a one-pager for my team.
- isostatic 8y agoWhen the regulation does not apply Your company is service provider based outside the EU. It provides services to customers outside the EU. Its clients can use its services when they travel to other countries, including within the EU. Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR. https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... IANAL etc
- FooBarWidget 8y agoI recently wrote about this subject (with sources). See these: https://www.joyfulbikeshedding.com/blog/2018-04-17-should-non-eu-websites-ban-eu-visitors-under-the-gdpr.html https://www.joyfulbikeshedding.com/blog/2018-04-17-should-no... https://news.ycombinator.com/item?id=17058645 https://news.ycombinator.com/item?id=17058645
- briandear 8y agoAnd “target” is such an arbitrary idea. Just existing could be argued as trying to target. The standard should be: “do you have a physical nexus in the EU.” That’s it.
- isostatic 8y agoIt's either "target", or it apples to all EU customers. "target" is far less of a problem for companies that don't consider their customers data to be important.