This document outlines the key considerations for determining if an organization is subject to GDPR regulations, including if the controller or processor is established in the EU, processes personal data of EU individuals outside the EU, or processes personal data where international public law applies. It also lists the core principles of GDPR around data protection, individual rights, security measures, and breach procedures. Exemptions are noted.

1. •
•
•
•
I. C OR P ESTABLISHED IN EU PROCESSING PD OR
II. C OR P ESTABLISHED OUTSIDE EU PROCESSING PD OF PEOPLE IN EU TO SELL GOODS/
SERVICES/MONITOR BEHAVIOUR OR
III. A CONTROLLER PROCESSING PD WHERE INTERNATIONAL PUBLIC LAW APPLIES
IF YES. ANY EXEMPTIONS APPLY? Y NO GDPR, N GDPR APPLIES
© DATA LEX CONSULTANCY 2019

2. •
•
•
I. GDPR PRINCIPLES
II. DATA SUBJECT RIGHTS
III. APPROPRIATE TECHNICAL AND ORGANISATIONAL MEASURES
IV. APPROPRIATE DATA BREACH PROCEDURE
•
© DATA LEX CONSULTANCY 2019

3. 1.
2.
3.
© DATA LEX CONSULTANCY 2019

4. •
•
•
•
•
•
•
© DATA LEX CONSULTANCY 2019