An online retailer is established in France and processes customer personal data for its EU shop. Processing equipment is hosted in a non-EU data centre. Which territorial-scope conclusion is correct?
Select an answer to reveal the explanation.
Short Explanation
Think of a French storefront that keeps its customer list on a rented warehouse abroad — the store is still a Union shop. GDPR follows the establishment context, not the rack location. Shipping the hard drives overseas does not erase EU rules.
Full Explanation
Article 3(1) applies the GDPR to processing of personal data in the context of the activities of an establishment of a controller or processor in the Union, regardless of whether the processing itself occurs in the Union. A French-established retailer processing customer data for its EU shop is therefore in scope even if equipment is hosted in a non-EU data centre. Establishment context protects people dealing with Union businesses irrespective of rack location—an important consumer-protection and civic design point of the Regulation.
Server location outside the Union does not remove the GDPR for an EU-established controller. The non-EU hosting country’s law does not become the sole governing privacy regime for that processing. Establishment scope is not limited to public authorities; private retailers are fully covered when Article 3(1) conditions are met.
Exam caveat: non-EU hosting may separately raise Chapter V transfer issues even while Article 3(1) clearly applies. Do not confuse territorial scope (does the GDPR apply?) with transfer tools (how may data leave the EEA?).
Operational check: keep the French establishment’s GDPR programme active for customer processing, document any transfers to the non-EU data centre with Chapter V safeguards and notice disclosures, and reject project claims that “offshore servers equal offshore GDPR.”