The General Data Protection Regulation governs the use of personal data of people located in the EU.
Who is affected
- Any business established in the Union that uses personal data, even if the data are processed elsewhere (Article 3(1)).
- An Asian company with no establishment in Europe, as soon as it offers goods or services to people who are in the Union (paid or free), or monitors their behaviour online (Article 3(2)).
The point that concerns Asia: the representative
A company covered by Article 3(2) must designate in writing a representative in a Union country where its customers are (Article 27(1) and (3)). Authorities and individuals can contact this representative. Exception: occasional processing, with no large-scale sensitive data and no risk for individuals (Article 27(2)).
What to do
- Have a legal basis for each use: consent is only one of six (contract, legal obligation, legitimate interest…) (Article 6).
- Inform people clearly (privacy policy).
- Answer requests (access, correction, erasure…) within one month; this can be extended by two months if the request is complex, provided the person is told within the first month (Article 12(3)).
- In the event of a data breach: notify the authority (in France, the CNIL) without undue delay and, where feasible, within 72 hours, unless the breach poses no risk to individuals; after 72 hours, explain the delay (Article 33).
Sending data to China, Thailand or Vietnam
A European company that sends personal data outside the Union (customer file, contact details) must meet certain conditions (Article 44): an adequacy decision of the Commission for that country (Article 45), or safeguards such as the standard contractual clauses adopted by the Commission (Article 46(2)(c)), or, failing that, an exception, for example the explicit consent of the person, informed of the risks (Article 49(1)(a)).
Dates
- Applicable since 25 May 2018 (Article 99).
Official source (text read on 01/11/2026) : Regulation (EU) 2016/679 (GDPR) — EUR-Lex · CNIL — the European regulation
General information, not legal advice. Check the official source before you decide.