The basics: what the law applies to

Whether the regulation applies to the organisation at all, and the words it uses for the parts that follow.

Article 2

Material scope

What it asks for

The regulation applies whenever personal data is handled by computer, or kept in an organised paper filing system. Purely personal or household activity is outside it.

For example

A twelve person design studio keeps a customer list in a spreadsheet and a folder of signed contracts. Both are in scope.

How Prudence covers it

Prudence assumes the regulation applies and starts from the processing operations the organisation carries out. No configuration is required to switch it on.

Article 3

Territorial scope

What it asks for

The regulation applies to organisations established in the EU, and to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour.

For example

A Canadian software company sells subscriptions to customers in Ireland and Germany. It is caught by the regulation even though it has no European office.

How Prudence covers it

The entity register records where each organisation is established and whether it needs a representative in the EU. Prudence raises a gap when an organisation outside the EU has no representative recorded.

Article 4

Definitions

What it asks for

The regulation defines the words the rest of it uses: personal data, processing, controller, processor, consent, personal data breach and the rest.

For example

A company decides why and how staff records are kept, so it is the controller. Its payroll bureau follows instructions, so it is a processor.

How Prudence covers it

Every field in Prudence uses the defined word rather than a house term, and the register reference explains each one in ordinary language at the point it is used.

All chapters Next: Principles and lawful grounds ↗