Exam CISSP topic 1 question 241 discussion

B is correct, GDPR is for all EU residents.

Citizens. D. Residents are protected by EU companies.

The General Data Protection Regulation (GDPR) applies to the personal data of EU residents, regardless of their nationality. GDPR protections are based on the residency of the data subjects, not their citizenship or the location where the data is processed.

D. EU citizens data. Ref official book chapter 5 page 210

GDPR is specifically designed to protect the personal information of EU citizens and residents. Therefore, it only applies to EU citizens and residents inside the EU. However, it also applies to all companies that process the personal data of EU citizens, regardless of whether or not a company is based in the EU.

...it imposes obligations onto organizations anywhere, so long as they target or collect data related to people in the EU. https://gdpr.eu/what-is-gdpr/

GDRP applies to residents and citizens of EU, you can assume a citizen is also a resident. GDPR applies too to EU citizens living outside the EU

GDPR is concerned with the protection of the personal data of EU citizens, and organizations processing such data must comply with GDPR regulations, regardless of the organization's physical location.

Only EU residents regardless of citizenship is protected by GDPR. EU citizens who are ouside EU (e.g., in the U.S.) are not protected by GDPR.

B. GDPR is concerned about data within the EU, and it doesn't mean just the citizen alone.

B - Scope, penalties, and key definitions First, if you process the personal data of EU citizens or residents, or you offer goods or services to such people, then the GDPR applies to you even if you’re not in the EU. https://gdpr.eu/what-is-gdpr/

Both the personal data of EU citizens and EU residents must be handled according to the privacy protections of GDPR, regardless of the location of the organization processing the data. Therefore, option B is correct.

CISSP Official Guide 9th Edition: A major difference between the GDPR and the data protection directive is the widened scope of the regulation. The new law applies to all organizations that collect data from EU residents or process that information on behalf of someone who collects it. Importantly, the law even applies to organizations that are not based in the EU, if they collect information about EU residents.

I go with B - EU residents.

GDPR The General Data Protection Regulation applies to all organizations that do business or market to European Union residents, even businesses with no physical EU presence. It addresses how the private data of EU residents is collected, secured, and used.

Answer is B. The article below confirms this. https://thorteaches.com/cissp-d1-preview-general-data-protection-regulation-gdpr/#:~:text=The%20General%20Data%20Protection%20Regulation,the%20EU%20and%20EEA%20areas. "it covers all the people that live in the EU, not just the citizens, everybody who is there. But then if you are an EU citizen and you live outside the EU, it does not cover you. You have to be physically present in the EU."

GDPR applies to data subjects situated in the EU (not restricted to EU citizens). Exact wording; “This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union” https://gdpr.eu/article-3-requirements-of-handling-personal-data-of-subjects-in-the-union/ https://www.ashurst.com/en/news-and-insights/legal-updates/territorial-scope-of-the-gdpr---where-does-the-boundary-lie/