A vendor claims the GDPR only applies to EU companies that keep servers inside the EU. Which response best corrects that myth at Domain I legislative-awareness level?
Select an answer to reveal the explanation.
Short Explanation
“We parked the servers in Frankfurt, so GDPR vanishes” is a myth. The GDPR is a real EU regulation with protective aims — scope turns on legal criteria like establishment and offering goods or services, not a hosting-location bumper sticker. Domain I is where you kill that slogan before deeper scope chapters.
Full Explanation
The GDPR is a directly applicable EU regulation with protective and free-flow goals; applicability is not reduced to an EU-servers-only slogan. Vendor myths that confine the Regulation to companies keeping servers inside the EU ignore establishment and certain targeting/offering scenarios developed in the territorial-scope rules. Server location inside the EU is not the sole test, and non-EU establishments are not always exempt regardless of offering services. The GDPR is not a voluntary code for companies that choose EU hosting brands. Only paper filing systems in Brussels are not the material scope. Domain I expects candidates to reject hosting-location folklore even before later domains drill the precise Article 3 tests. Exam caveat: watch for “servers in the EU” distractors that substitute infrastructure geography for legal scope. Operational check: when onboarding a non-EU SaaS tool used by a city website aimed at residents, run an Article 3 applicability memo and a transfer analysis—do not close the file merely because a vendor offered an EU region checkbox. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion.