Exam CIPP-E topic 1 question 20 discussion

If a non EU business processes EU data incidentally and without targeting EU customers, the GDPR does not apply. Therefore B is not a given. If a business specifically targets EU customers, the GDPR *always* applies. Therefore D is the correct answer.

The option that would MOST likely trigger the extraterritorial effect of the GDPR, as specified by Article 3, is: D. Personal data of EU residents being processed by a non-EU business that targets EU customers. Option B, while involving the personal data of EU citizens being processed by a controller or processor based outside the EU, is not as explicitly tied to the targeting of EU residents or the monitoring of their behavior as specified in Article 3.

B is the right answer because targeting EU 'residents' is n ot the same as 'EU citizens'

If a business specifically targets EU customers, the GDPR *always* applies. Therefore D is the correct answer.

Option D is the most likely to trigger the extraterritorial effect of the GDPR, as specified by Article 3, because it involves a non-EU entity engaging in activities (processing personal data of EU residents) that directly target individuals within the EU.

agreed, the correct answer is D