Context comes before conclusions
GDPR is the European data protection regulation. Its territorial scope can cover activities of EU establishments and, in certain situations, operations of companies outside the EU.
Blugreen organizes facts and questions so analysis starts with the company's actual activity, the people involved and the data processing performed.
Three connections to investigate
Establishment in the European Union
Data processing in the context of an EU establishment's activities.
Offering goods or services
Operations related to offering goods or services to people in the EU, including where no payment is required.
Behavior monitoring
Processing related to monitoring people's behavior when that behavior takes place in the EU.
These connections, set out in GDPR Article 3, guide screening questions. Determining their application requires specialist assessment of the context.
What to gather for screening
- Where the company is established and how operations are organized
- Which products and services are offered and to which audiences
- How the EU commercial presence relates to processing
- Which activities involve behavior monitoring
- Which systems, suppliers and flows participate in the process
- What remains unknown and who can confirm each item
Documented screening with indications, uncertainties and references to guide deeper analysis.
When assessment extends to security
Article 32 links processing security to risk and operational context. It covers technical and organizational measures, including protection, availability, recovery and effectiveness assessment, as appropriate.
With a defined assessment scope, work can gather available settings and evidence, link the data and systems involved and record checks performed.
Explore storage and lifecycle assessmentFrom uncertainty to a verifiable question
A Brazilian company is preparing an offering for people in the EU and plans to collect registrations for that service.
Screening can organize the intended audience, commercial activity, collected data, suppliers and information flows. These facts support relevant questions for specialist analysis.
The same company may also need to organize its Brazilian data protection context. The two areas retain their own questions and references.
Prepare an assessment with the right facts
Start by describing the activity and its operational connections. For a specific international situation, agree which questions, systems and documents should be in scope.
Discuss GDPR assessment