A non-EU parent company operates an EU branch that processes employee personal data for local HR. Which territorial-scope statement is correct?
Select an answer to reveal the explanation.
Short Explanation
A foreign chain with a real EU shop still runs that shop under Union privacy rules for what the shop does — including its local staff files. Parent HQ abroad does not cloak the branch’s HR processing. Employee data is not a magic carve-out from establishment scope.
Full Explanation
Article 3(1) covers processing in the context of the activities of an establishment in the Union. An EU branch that conducts local HR processing is a classic establishment-context scenario. The foreign parent’s home law does not displace GDPR for that EU-context processing. The establishment criterion is not limited to customer databases.