gdpr
I live outside of Europe. If I gain e-Residency in Estonia, will I be protected by GDPR regulations?
<p>Are people who gain an Estonian e-Residency treated as a European citizen under upcoming GDPR regulations?</p>

<p>Whether or not you are protected by GDPR depends on the <em>location</em> of both yourself and the party processing your data. Citizenship and residence statuses are completely irrelevant (<a href="https://gdpr-info.eu/recitals/no-14/" rel="nofollow noreferrer">Recital 14(1)</a>):</p>

<blockquote>
  <p>The protection afforded by this Regulation should apply to natural
  persons, whatever their nationality or place of residence</p>
</blockquote>

<p>If the party processing your data is established in the EU, then you are protected no matter who you are or where you are (<a href="https://gdpr-info.eu/art-3-gdpr/" rel="nofollow noreferrer">Art. 3(1)</a>):</p>

<blockquote>
  <p>This Regulation applies to the processing of personal data in the
  context of the activities of an establishment of a controller or a
  processor in the Union, regardless of whether the processing takes
  place in the Union or not.</p>
</blockquote>

<p>If the party processing your data is not established in the EU, then you are only protected if you are in the EU (<a href="https://gdpr-info.eu/art-3-gdpr/" rel="nofollow noreferrer">Art. 3(2)</a>):</p>

<blockquote>
  <p>This Regulation applies to the processing of personal data of data
  subjects who are in the Union by a controller or processor not
  established in the Union</p>
</blockquote>

<p>I think @Greendrake's answer is substantially correct, with the possible exception of the last bit regarding Art. 3(2), and non-protection if not &quot;within the Union&quot;; at least as the GDPR is implementated <em>by Estonia</em>, <em>within Estonian jurisdiction</em>, <em>as regards e-residents</em>, and, (interestingly) also <em>potential</em> e-residents.</p>
<p>See: <a href="https://e-resident.gov.ee/privacy-policy" rel="nofollow noreferrer">https://e-resident.gov.ee/privacy-policy</a></p>
<p>&quot;<strong>The legal basis for such processing is Your consent that You have given when You have applied for e-resident digi-ID (GDPR art 6(1)(a))</strong>. You have the right to withdraw Your consent at any time by contacting us on the contact details below. The withdrawal of consent does not affect the lawfulness of the processing based on consent before its withdrawal.</p>
<p>We may also process Your personal data to fulfil our legal obligations (GDPR art 6 (1) (c)) and to protect our legal rights (e.g. to file claims, to protect ourselves from claims), in which case the legal basis for such processing is our legitimate interest that overrides <strong>Your interests and fundamental rights and freedoms which require protection of personal data (GDPR art 6(1)(f)).</strong>&quot;</p>
<p>Effectively, by way of claiming their obligations under GDPR 6(1)(c) <strong>override</strong> rights granted in 6(1)(f), they semi-explicitly acknowledge they that e-residency applicants *have such &quot;fundamental rights and freedoms&quot;.</p>
