Why would a company need to comply with the General Data Protection Regulation?

• A. Processes data from individuals in the European Union
• B. Stores credit card information
• C. Is publicly traded in the United States
• D. Faces pervasive cyber-threats

Answer: (A)

The main idea is that GDPR applies whenever a company processes the personal data of individuals located in the European Union, even if the company itself isn’t based there. If you collect, store, or use information that can identify someone in the EU—such as names, emails, or IP addresses—you’re handling personal data under GDPR. This becomes especially true if your products or services are directed at EU residents or you monitor their behavior online. The focus is on the data subjects and how their data is processed, not on the company’s location or its industry or security posture, so processing EU residents’ data triggers GDPR obligations with rights for data subjects and potential penalties for non-compliance.

Storing credit card information isn’t what makes GDPR apply by itself, since payment data handling falls under specific payment security rules, while GDPR covers broader personal data processing. Being publicly traded in the United States doesn’t affect GDPR applicability. Merely facing cyber-threats doesn’t establish GDPR obligations; GDPR is about how personal data is processed, not about threat levels.