Which compliance standard should a company consider if both controllers and processors have legal entities in the EU?

The General Data Protection Regulation (GDPR) is the primary data protection and privacy law for the European Union (EU). The question specifically mentions "controllers" and "processors," which are legal roles explicitly defined in Article 4 of the GDPR. Furthermore, Article 3 of the GDPR establishes its territorial scope, which applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. Given that the company has legal entities in the EU, it falls directly under the jurisdiction of GDPR.

A. PCI-DSS is a global security standard for entities that handle branded credit cards, not a general data privacy law based on EU presence.

C. The Safe Harbor framework was a data transfer mechanism between the EU and the US that was invalidated in 2015 and is no longer in effect.

D. LGPD (Lei Geral de Proteção de Dados) is Brazil's data protection law and applies to data processing activities within Brazil, not the EU.

1. European Parliament and Council of the European Union. (2016). Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Official Journal of the European Union

L 119/1.

Article 3

"Territorial scope

" Section 1: Establishes applicability for controllers or processors with an establishment in the EU.

Article 4

"Definitions

" Sections 7 & 8: Provides the legal definitions for 'controller' and 'processor'.

2. UC Berkeley School of Law. (2018). Taking Stock of the GDPR: A Review of its Impact and a Look to the Future. Berkeley Center for Law & Technology.

Section II.A

"The GDPR's Broad Scope": Discusses the regulation's application based on the establishment of a controller or processor within the EU.

3. Hoofnagle

C. J.

& Urban

J. M. (2020). Cybersecurity in Context. University of California

Berkeley

School of Law.

Chapter 10

"The General Data Protection Regulation": Explains the roles of controllers and processors and the territorial scope as the foundational principles of GDPR compliance.