Aor an authorized operator not established in the EU if the processing activities are related to providing goods or services to them or monitoring their behavior in the EU. It is not relevant whether or not the actual data processing takes place within the EU. In terms of substantive requirements compared to the Directive the GDPR introduces new obligations and greater compliance expectations for controllers for example in relation to transparency consent liability confidentiality data protection impact assessment data breach notification new rights of data subjects employment of proxies and processing agreements of the data for the first time legal obligations are imposed directly on data controllers for example in terms of.
Liability recruitment of other data processors data security and notification Country Email List of data security breaches and Severe penalties for noncompliance with the law. What are the practical implications that have not yet fallen within the scope of EU data protection law will be directly subject to its requirements for example because they are EU operators or nonEU operators targeting services EU residents e.g. via a website or monitor their behavior e.g. via cookies. Perhaps the biggest change is that controllers and processors that are not established in the EU but collect and process data about EU residents through websites cookies and other remote activities are likely to be included in the scope of the GDPR.
Ecommerce providers online behavioral advertising networks analytics companies that process personal data will be covered by the scope of the GDPR. So what should businesses do now businesses should review their data collection and use operations to understand the basis on which they collect and use data. if you are an operator established in the EU prepare your plan to adapt to GDPR requirements. if you are a nonEU operator assess whether your online activities involve providing goods or services or monitoring the behavior of EU residents and whether you use EU data operators. In this case they are.