An online retailer is established in France and processes customer personal data for its EU shop. Processing equipment is hosted in a non-EU data centre. Which territorial-scope conclusion is correct?
Select an answer to reveal the explanation.
Short Explanation
Think of a French storefront that keeps its customer list on a rented warehouse abroad — the store is still a Union shop. GDPR follows the establishment context, not the rack location. Shipping the hard drives overseas does not erase EU rules.
Full Explanation
Article 3(1) applies the GDPR to processing of personal data in the context of the activities of an establishment of a controller or processor in the Union, whether or not the processing takes place in the Union. Equipment location does not defeat establishment-based scope. Private retailers are fully covered when established in the Union.