The European Union's General Data Protection Regulation
(GDPR) came into effect nearly nine months ago on May 25, 2018. The
GDPR clearly applies to those located in the EU, but its
application is worldwide in that it expressly imposes obligations,
liability and contractual terms on businesses operating outside the
EU (including Canada).
The GDPR applies to and imposes obligations and liabilities on
both data controllers and data processors that process personal
data on EU-based individuals regardless of whether the processing
takes place in the EU, where the processing activities relate to
the offering of goods or services to individuals in the EU (payment
not required) or where there is monitoring of the individual's
behaviour where the behaviour being monitored is in the EU. Data
controllers determine the purposes and means of the processing of
personal data. A data processor processes personal data on behalf
of a data controller.
