Misquoted Confidence: high
Primary source found, but the way it is quoted changes the subject, metric, population or precision.
Safe rephrasing
GDPR also covers businesses outside the EU when they offer goods or services to people in the EU or monitor their behaviour there.
What the source says
This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: the offering of goods or services
European Union (GDPR Art. 3) — Regulation (EU) 2016/679, Article 3 (territorial scope)
- Commonly cited as
- "We're a US company, GDPR doesn't apply"
- True origin
- European Union (GDPR Art. 3) — Regulation (EU) 2016/679, Article 3 (territorial scope)
- Type
- Stat check: A widely repeated statistic traced back to its origin.
- Year
- 2016 (applies since May 2018)
- Data as of
- In force
- Last checked
- Method & sample
- Text of the regulation (via gdpr-info.eu).
- Drift between quote and source
- Scope: non-EU businesses are covered when they offer goods or services to, or monitor the behaviour of, people in the EU
- Interest
- n/a (statutory or regulatory text).
Sources we opened
- GDPR Art. 3 (gdpr-info.eu) primary