What companies must comply with GDPR?

The General Data Protection Regulation (GDPR) is a major European regulation that governs the protection of individuals' personal data. But which companies must actually comply with the GDPR? Here is a guide to understanding which companies are subject to this regulation and what their obligations are:

1. Companies established in the European Union (EU):

All companies established in the European Union must comply with the GDPR, regardless of their sector of activity or size. This includes sole proprietorships, small and medium-sized enterprises (SMEs) as well as large multinational corporations.

2. Companies not established in the EU, but targeting EU residents:

Companies located outside the European Union must also comply with the GDPR if they offer goods or services to EU residents or if they monitor their behaviour, particularly by using cookies or other online tracking technologies.

3. Companies processing personal data:

All companies that process personal data must comply with the GDPR, whether it involves data from customers, employees, suppliers or other stakeholders. The processing of personal data includes the collection, storage, use, transmission and deletion of such data.

4. Companies in all sectors of activity:

The GDPR applies to all companies, regardless of their sector of activity. This includes companies in the healthcare, finance, technology, retail, education, real estate sectors and many other fields.

5. Companies of all sizes:

The GDPR applies to companies of all sizes, from micro-enterprises to large multinationals. Small businesses may benefit from certain exemptions or simplifications, but they must still comply with the fundamental principles of the GDPR.

Obligations of companies under the GDPR:

Companies subject to the GDPR have several obligations, including:

• Obtaining, in certain cases, the consent of individuals before collecting their personal data.
• Informing individuals about how their data will be used and processed.
• Protecting personal data against any loss, unauthorised disclosure or unauthorised access.
• Respecting individuals' rights over their personal data, such as the right of access, rectification, erasure and portability.
• Reporting data breaches to the competent data protection authority and informing affected individuals when necessary.
• And much more.

In conclusion, all companies that collect, use or process personal data must comply with the GDPR, whether they are established in the European Union or target EU residents. By complying with GDPR requirements, companies can strengthen their customers' trust and avoid potential fines and penalties.