Which organizations need to comply with the General Data Protection Regulation (GDPR)?

The territorial scope of the GDPR is defined in Article 3. It applies to organizations established within the European Union (EU), regardless of where the data processing takes place. This is known as the "establishment criterion." Furthermore, the GDPR has an extraterritorial effect, applying to organizations outside the EU if their processing activities relate to offering goods or services to data subjects in the EU or monitoring the behavior of data subjects within the EU. Option D correctly summarizes both the establishment criterion and the key aspects of the extraterritorial "targeting criterion."

A. This is too narrow. The GDPR's scope is not limited to the data of employees but covers all data subjects in the EU.
B. This is incorrect. The regulation applies to any "establishment" in the EU, not just headquarters, and also has extraterritorial application.
C. This is too broad. The GDPR is not a global law; its application requires a specific connection to the EU or its data subjects.

1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), Official Journal of the European Union, L 119/1. Article 3, "Territorial scope."

2. European Data Protection Board (EDPB). (2019). Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) - Version 2.1. Adopted on 12 November 2019. Paragraphs 7-9, which state, "Article 3 specifies the territorial scope of the GDPR in two main sections: Article 3(1) sets out the ‘establishment’ criterion, while Article 3(2) clarifies the ‘targeting’ criterion."

3. De Hert, P., & Czerniawski, M. (2016). "Expanding the European data protection scope beyond the territory: Article 3 of the General Data Protection Regulation in its wider context." International Data Privacy Law, 6(3), 230–244. Section 3, "The territorial scope of the GDPR." https://doi.org/10.1093/idpl/ipw010