Q&As

If a foreign cloud processing company (Foreign Co), with no establishment in the EEA provides services to EEA established data controllers, who in turn contract with Foreign Co to process personal data of EEA data subjects—is Foreign Co caught under GDPR?

read titleRead full title
Produced in partnership with Shobana Iyer of Swan Chambers
Published on LexisPSL on 04/07/2018

The following Information Law Q&A produced in partnership with Shobana Iyer of Swan Chambers provides comprehensive and up to date legal information covering:

  • If a foreign cloud processing company (Foreign Co), with no establishment in the EEA provides services to EEA established data controllers, who in turn contract with Foreign Co to process personal data of EEA data subjects—is Foreign Co caught under GDPR?
  • Establishment test
  • Goods and services test and monitoring test
  • Impact of the GDPR applying

If a foreign cloud processing company (Foreign Co), with no establishment in the EEA provides services to EEA established data controllers, who in turn contract with Foreign Co to process personal data of EEA data subjects—is Foreign Co caught under GDPR?

The GDPR became directly applicable and enforceable in the EU on 25 May 2018. It should be noted that although the text of the GDPR refers throughout to the ‘Union’, it is stated on page one of the regulation that it is a text ‘with EEA relevance’, meaning all provisions are intended to be applicable in respect of all EEA members, not just those that also have EU membership. Once the GDPR is incorporated into the EEA Agreement and in force, references to EU Member States in the GDPR can generally be read to also include EEA members. This Q&A is therefore drafted from the perspective of the position once the GDPR is incorporated into the EEA Agreement and refers throughout to the EEA for simplicity. For further information on progress with that incorporation, see the European Free Trade Association’s GDPR tracker.

The GDPR is a complex and principles based regulation, the text of which lacks clarity in a number of areas and upon which there is currently limited guidance from regulators. Consequently, relevant supervisory authorities and/or courts may ultimately reach different views as to

Popular documents