A non-EU parent company operates an EU branch that processes employee personal data for local HR. Which territorial-scope statement is correct?
Select an answer to reveal the explanation.
Short Explanation
A foreign chain with a real EU shop still runs that shop under Union privacy rules for what the shop does — including its local staff files. Parent HQ abroad does not cloak the branch’s HR processing. Employee data is not a magic carve-out from establishment scope.
Full Explanation
Processing carried out in the context of the activities of an establishment of a controller in the Union falls under Article 3(1). An EU branch of a non-EU parent that processes employee personal data for local HR typically brings that processing within GDPR territorial scope because the establishment’s activities are closely entangled with the processing. Workers in the Union receive GDPR protections for their employment data even when the ultimate parent is foreign—a core labour-privacy outcome of territorial design.
EU-branch employee data are not outside the GDPR merely because the parent company is foreign. The parent’s home privacy statute does not exclusively govern EU-branch HR files. Establishment context is not limited to customer data; employees are data subjects with the same territorial protections when Article 3(1) applies.
Exam caveat: transfers of HR files to the non-EU parent still need Chapter V tools in addition to confirming territorial scope. Joint-controller or processor characterisation may also arise depending on who determines purposes and means for which processing operations.
Operational check: apply GDPR employee notice, lawful bases, and retention rules at the branch, document any parent-company transfers with appropriate safeguards, and stop relying on “foreign parent overrides GDPR” talking points when HR exports data.