internet european-union gdpr
Do companies have the right to demand proof of being present in the EU before executing a GDPR request?
<p>Under the GDPR, any company doing business in the EU must remove EU users' personal data upon request from that user.</p>

<p>Since the statute only applies to persons present in the EU, are companies legally permitted to demand that a user requesting personal data removal supply proof that they are present in the EU, so that they can deny the request to those outside?</p>

<blockquote>
  <p>the statute only applies to EU residents</p>
</blockquote>

<p><strong>Wrong.</strong></p>

<p>GDPR applies to everyone in the EU (<a href="https://gdpr-info.eu/art-3-gdpr/" rel="nofollow noreferrer">Art. 3</a>). This means tourists are also covered. Residence status is completely irrelevant (<a href="https://gdpr-info.eu/recitals/no-14/" rel="nofollow noreferrer">Recital 14(1)</a>):</p>

<blockquote>
  <p>The protection afforded by this Regulation should apply to natural
  persons, whatever their nationality or place of residence</p>
</blockquote>

<p>There is no provision for data processors/controllers to demand proof from data subjects of them being located in the EU. You can challenge them, but if they refuse to provide proof you will still be liable to fulfill their GDPR request should they indeed be <em>present</em> in the EU.</p>

<p>I don't think it would be acceptable, in most cases, to demand such proof:</p>

<blockquote>
  <p>It shall be as easy to withdraw as to give consent.
  <a href="https://gdpr-info.eu/art-7-gdpr/" rel="nofollow noreferrer">(art. 7.3)</a></p>
</blockquote>

<p>So if the user <em>was</em> indeed covered by the GDPR, it is probably against it to require that (I don't know about your procedure, but you probably don't require any similar proof for signing up).</p>
