ITPEC IP October 2024 Question 75
Topic: Legal Affairs
Concerning the EU’s General Data Protection Rules (GDPR), which of the following lists all and only the appropriate descriptions?
A:If a business has an office within the EU region and provides data and services within the EU region, it is subject to the rules.B:If a business has an office within the EU region and provides data and services to Asia, the US, or other such places outside of the EU region, it is not subject to the rules.C:If a business does not have an office within the EU region and provides data and services only to Asia, the US, or other such places outside of the EU region, it is not subject to the rules.D:If a business does not have an office within the EU region and provides data and services from Asia, the US, or other such places to the EU region, it is not subject to the rules.
Explanation
A and C — GDPR applies either through an establishment in the EU, or, without one, through offering goods or services to people in the EU or monitoring them there.
- •A — an office in the EU providing services in the EU: subject to GDPR. Appropriate
- •B — an office in the EU serving customers outside the EU: GDPR still applies to processing done in the context of the EU establishment, wherever the data subjects are. Not appropriate
- •C — no office in the EU and services only outside the EU: neither ground applies, so not subject. Appropriate
- •D — no office in the EU but services provided to the EU: GDPR applies extraterritorially to businesses offering goods or services to people in the EU. Not appropriate
Answer (c)
Why not others:
- •(a) A — misses C, which is also a correct statement
- •(b) A, B, C — includes B, but an EU establishment does not escape GDPR because its customers are outside the EU
- •(d) A, C, D — includes D, but a non-EU business targeting people in the EU is covered by GDPR's extraterritorial scope
Key rule: GDPR scope follows the EU establishment or the EU-based people being served or monitored, not only where the company is located; non-EU companies selling into the EU must comply.
Legal Affairs · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.