european-union gdpr data-protection
Parent company GDPR compliance
<p>Situation:
Parent company is registered in the EU member state but does not do b2c business in the EU and does not process personal data of Europeans. Subsidiaries are not EU companies and  does not do b2c business in the EU and does not process personal data of europeans.
<strong><em>Is it true that the parent company must comply with the GDPR just because it is registred in the EU (even if does not really do business in the EU)?</em></strong></p>

<p><strong>Yes the parent company does need to comply with GDPR</strong></p>

<p>To quote the UK information commissioner:</p>

<blockquote>
  <p>The GDPR applies to processing carried out by organisations operating
  within the EU. It also applies to organisations outside the EU that
  offer goods or services to individuals in the EU.</p>
</blockquote>

<p><a href="https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/" rel="nofollow noreferrer">https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/</a></p>

<p>And from the regulation itself:</p>

<blockquote>
  <p>Any processing of personal data in the context of the activities of an
  establishment of a controller or a processor in the Union should be
  carried out in accordance with this Regulation, regardless of whether
  the processing itself takes place within the Union</p>
</blockquote>

<p><a href="http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&amp;from=EN" rel="nofollow noreferrer">http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&amp;from=EN</a></p>

<p>(Point 22)</p>
