Does the GDPR apply to a processor processing personal data on behalf of a controller outside the EEA?

ANSWER

If the data controller is an entity from outside the EEA, it is first necessary to check which legal rules apply in the controller's territory. Processing of personal data (if not carried out under the GDPR) will take place on the basis of the data protection legislation applicable in the country where that controller is established.

Processing on behalf of the controller should therefore be aligned not with the GDPR but with the rules of the country in which the controller is established. Chapter V of the GDPR, i.e. Articles 44–50, applies where a controller or processor transfers data to a third country, but those entities are subject to the General Data Protection Regulation. Under Article 2(2)(a) GDPR, the Regulation does not apply to processing of personal data in the course of an activity not subject to Union law.