Introduction – The challenge of
extra-territoriality for non-EU businesses and GDPR
Since the introduction of the General Data Protection Regulation
(GDPR) in 2018, Australian businesses, like other
non-EU domiciled businesses around the world, have grappled with
the extra-territorial operation of the GDPR, particularly in the
absence of a body of clear judicial interpretation on the point. It
lead to something of a compliance conundrum for businesses without
an EU establishment but who were arguably targeting individuals in
the EU in the ordinary course. Local EU Member State regulatory
guidance provided some indicia by which to assess this issue, but
was only just that, guidance, as to whether GDPR applies.
