Commercial relationships and, in general, almost all relationships very often involve the processing of personal data. It is also now very common to develop business cross-border, and if your business brings you in the European Union (or more precisely in the EEA territories), then it may be necessary to comply with their regulations and in particular their GDPR regulations.
The very first thing to consider, is that, to have a business in the EU, if this involves the processing of European’s people personal data, you’ll need to appoint a representative in EU.
First of all, it could be useful to understand when GDPR must be applied.
The core principle is that if you are processing personal data (from any part of the world) of a subject who is in the Union or if the processing of data is made in the Union (no matter where the subject is located), then you have to comply to GDPR rules.
Article 4 of the GDPR clarifies that its application is required as follows:
- in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not
- to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
- the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
- the monitoring of their behaviour as far as their behaviour takes place within the Union
3. to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.
There is a distinct advantage of having a good understanding of GDPR rules in the EU or, more realistically, of relying on a legal structure that is vertically specialised in this area. Having a deep understanding of GDPR, means avoiding concerns about a developing business by risking penalties or delays in implementing solutions due to a misinterpretation of the rules and lack of awareness of the significant room for manoeuvre offered by the GDPR
Our company can support this objective: Area Legale was born from the synergistic encounter between the world and expertise of corporate lawyers and that of traditional lawyers, providing advice on the processing of personal data and assisting companies in the management of complex legal issues. We provide our expertise in several areas of activity:
- consultancy to the controller’s/ processor’s structure on personal data protection and Artificial Intelligence regulation
- assumption of the role of Data Protection Officer
- support and assistance to the in-house Data Protection Officer
- assistance and support to the in-house Privacy Office or outsourcing of the relevant activities
- training in data protection
- gap analysis and NIS2 compliance process
- AGCOM regulations on contact centre activities
- support in the verification of the obligation to appoint the representative, i.e. the person established in the Union who is designated by the controller or processor in writing pursuant to Article 27 GDPR
- assumption of the role of representative referred to in the preceding point
- leading with requirements of UK Data Privacy Act when connecting with European GDPR.
Ensuring compliance with GDPR and data privacy plays an essential role in business development, thanks to its ability to guarantee high standards of both reliability and ethical activity, as well as trust through transparency and legality. For this reason, we firmly believe that personal data protection can be a lever for business in the Italian market and beyond.
