Regulation (EU) 2016/679

GDPR compliance: scope, obligations and the data protection officer mandate

GDPR compliance starts with one question. A company established outside the European Union may fall within the Regulation before it has any establishment there. Whether it does is settled by Article 3, and nothing else: not the location of the servers, not the nationality of the customers, not the place of incorporation. Sila establishes that position first, then carries out the data mapping on which the Article 30 records, the impact assessments and the processor contracts all depend.

By Younès Lahrach, data protection specialist and external DPO, director of Sila International Advisory. First published on , last reviewed against the texts on .

Who is caught

Article 3(1) applies the Regulation to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing itself takes place in the Union.

Article 3(2) extends it to controllers and processors not established in the Union, where the processing relates to the offering of goods or services to data subjects in the Union, irrespective of whether a payment is required, or to the monitoring of their behaviour as far as that behaviour takes place within the Union.

The distinction is not academic. Where Article 3(2) is the basis, Article 27 requires the controller or processor to designate a representative in writing, established in one of the Member States where the data subjects are located, subject to the exemptions in Article 27(2). Where Article 3(1) applies, that obligation does not arise.

Controller or processor

Article 4(7) and 4(8) distinguish the entity that determines the purposes and means of the processing from the one that processes on its behalf. The same company is frequently both, for different processing activities. The qualification is made activity by activity, not once for the organisation.

Joint controllers, Article 26

Where two or more controllers jointly determine the purposes and means, they must determine their respective responsibilities in a transparent arrangement, in particular as regards the exercise of data subject rights and the information duties of Articles 13 and 14. The essence of that arrangement must be made available to data subjects.

Concrete obligations

Records of processing activities, Article 30

The exemption for organisations with fewer than 250 employees in Article 30(5) falls away as soon as the processing is likely to result in a risk to rights and freedoms, is not occasional, or involves special categories of data under Article 9 or criminal conviction data under Article 10. Payroll and a recurring customer file are not occasional, so the exemption rarely holds in practice.

Lawful basis, Article 6

Every processing activity requires one of the six bases in Article 6(1), identified before the processing begins and recorded. Special categories of data additionally require an exception under Article 9(2).

Processor contracts, Article 28(3)

Any processing carried out by a processor must be governed by a contract setting out the subject matter, duration, nature and purpose of the processing, and containing the eight obligations listed in Article 28(3), including documented instructions, confidentiality, security, sub-processor conditions, assistance, deletion or return, and audit rights.

Transfers, Chapter V

A transfer to a third country requires an adequacy decision under Article 45, or appropriate safeguards under Article 46 — standard contractual clauses, binding corporate rules — together with an assessment of the law of the destination country, or one of the derogations in Article 49.

Data protection impact assessment, Article 35

Required where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons, and in particular in the three cases listed in Article 35(3): systematic and extensive automated evaluation including profiling, large-scale processing of special categories, and large-scale systematic monitoring of a publicly accessible area.

Breach notification, Article 33

Notification to the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach, unless it is unlikely to result in a risk to rights and freedoms. Beyond 72 hours, the notification must be accompanied by reasons for the delay. Where the risk is high, Article 34 additionally requires communication to the data subjects.

Penalties and competent authority

Article 83(5) sets the higher ceiling at EUR 20 000 000 or, in the case of an undertaking, 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher. It covers infringements of the principles in Articles 5, 6, 7 and 9, of data subject rights in Articles 12 to 22, and of the transfer rules in Articles 44 to 49.

Article 83(4) sets a ceiling of EUR 10 000 000 or 2 % for the obligations of controllers and processors under Articles 8, 11, 25 to 39, and 42 and 43.

Article 56 designates the supervisory authority of the main establishment as lead authority for cross-border processing, under the cooperation and consistency mechanism of Chapter VII. Where the controller has no establishment in the Union, that mechanism does not apply and each concerned authority is competent on its own territory.

How Sila engages

The engagement starts with qualification: establishment under Article 3(1), targeting under Article 3(2), and the role of controller or processor. That qualification alone determines the extent of the obligations, and it governs the rest of the work.

It continues with mapping and the drafting of the Article 30 records, review of the Article 6 lawful bases, contractual alignment with processors under Article 28(3), framing of Chapter V transfers, impact assessments under Article 35 where required, and the procedures for responding to data subject requests and for notifying within 72 hours.

Sila acts as data protection officer on the basis of a service contract, a possibility expressly provided for by Article 37(6). The officer is involved in all issues relating to the protection of personal data (Article 38(1)), receives no instructions regarding the exercise of those tasks (Article 38(3)), and their contact details are published and communicated to the supervisory authority (Article 37(7)).

The method, in four steps

  1. 01Gap assessment

    Establishing whether, and on what basis, the instrument applies to the activity as it is actually carried out, then comparing what the instrument requires against what already exists inside the organisation. The assessment ends with a ranked list of gaps, not an overall score. An organisation that falls outside the scope learns so at this stage, and the engagement stops there.

  2. 02Mapping

    Recording what the measures will apply to: processing activities and data flows, systems, service providers, contracts in force, roles and responsibilities. The map is the working document for everything that follows, and it is the document produced to a supervisory authority in the event of an inspection.

  3. 03Technical and organisational measures

    Implementing the measures the mapping has shown to be necessary: internal procedures, policies, contractual clauses to be renegotiated with providers, governance decisions, and training for the people concerned. Measures that sit inside the information system are specified by Sila and implemented by your own teams or your IT provider.

  4. 04Evidence file

    Assembling the file that can be produced to a supervisory authority: records, impact assessments, dated and versioned policies, decision trails, proof of training. Compliance is not demonstrated by the absence of an incident but by the production of this file, which means it has to be kept current once the engagement ends.

A tailored quotation within 48 hours

The scope of an engagement cannot be guessed at: it depends on whether and how the instrument applies to you, on the number of processing activities, systems and contracts involved, and on what already exists inside your organisation. No amount is therefore published on this site.

The process starts with a scoping discussion, at no charge and without commitment, to define what the engagement will cover. A tailored quotation follows within 48 hours, setting out the scope, the deliverables and the amount.

Frequently asked questions

Does a company established outside the EU have to comply with the GDPR?

Yes, where Article 3(2) of Regulation (EU) 2016/679 is satisfied, that is, where the processing relates to the offering of goods or services to persons in the Union, whether or not payment is required, or to the monitoring of their behaviour within the Union. The location of the registered office is irrelevant. Article 27 then requires the written designation of a representative established in a Member State where the data subjects are located, subject to the exemptions in Article 27(2).

Within what period must a personal data breach be notified?

Article 33(1) of Regulation (EU) 2016/679 requires the controller to notify the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Beyond 72 hours, reasons for the delay must be given. Where the breach is likely to result in a high risk, Article 34 additionally requires communication to the data subjects without undue delay.

What is the maximum GDPR fine?

Article 83(5) of Regulation (EU) 2016/679 sets the higher ceiling at EUR 20 000 000 or, in the case of an undertaking, 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher. It applies in particular to infringements of the principles in Articles 5, 6, 7 and 9, of the data subject rights in Articles 12 to 22, and of the transfer rules in Articles 44 to 49. A ceiling of EUR 10 000 000 or 2 % applies to the infringements listed in Article 83(4).

Can the data protection officer be external to the company?

Yes. Article 37(6) of Regulation (EU) 2016/679 provides that the data protection officer may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract. In both cases Article 38(3) guarantees that no instructions are given regarding the exercise of those tasks, and Article 37(7) requires publication of their contact details and communication of them to the supervisory authority.

Are companies with fewer than 250 employees exempt from keeping records of processing?

Rarely in practice. Article 30(5) of Regulation (EU) 2016/679 reserves the exemption to organisations with fewer than 250 employees, but it falls away as soon as the processing is likely to result in a risk to the rights and freedoms of data subjects, is not occasional, or involves the special categories of data in Article 9 or the criminal conviction data in Article 10. Payroll and a recurring customer file, not being occasional, remove the exemption.

What this regime triggers elsewhere

A business subject to the GDPR under Article 3(2), with no establishment in the Union, must in principle designate in writing a representative established in a Member State where the data subjects are, unless an Article 27(2) exemption applies.

Appointing your EU representative under Article 27

A high-risk AI system that processes personal data falls under both instruments at once. Article 27 of Regulation (EU) 2024/1689 requires certain deployers to carry out a fundamental rights impact assessment, distinct from the data protection impact assessment under Article 35 GDPR but able to build on it where that assessment has already been carried out.

Classifying an AI system under the AI Act

A financial entity contracts with the same provider both as a processor under Article 28 GDPR and as an ICT third-party service provider under Article 30 of Regulation (EU) 2022/2554. The two sets of clauses sit in the same contract and have to be negotiated together.

Framing ICT providers under DORA

A single breach can trigger two notification duties, to two different authorities, on two different timescales: 72 hours to the data protection authority under Article 33 GDPR, 24 hours to the competent authority under Article 23 of Directive (EU) 2022/2555. Both procedures have to be written before the incident.

Establishing whether NIS2 applies

Where appointment is mandatory under Article 37 or adopted voluntarily, the mandate may be performed on the basis of a service contract within the meaning of Article 37(6).

Appointing a data protection officer under mandate

Reference texts

The information on this page is general in nature and does not constitute legal advice on a specific situation. Sila is not a law firm and does not provide representation before the courts.