Certified Information Privacy Professional – Europe (CIPP/E) — Question 54

If a French controller has a car-sharing app available only in Morocco, Algeria and Tunisia, but the data processing activities are carried out by the appointed processor in Spain, the GDPR will apply to the processing of the personal data so long as?

Answer options

• A. The individuals are European citizens or residents.
• B. The data processing activities are in Spain.
• C. The data controller is in France.
• D. The EU individuals are targeted.

Correct answer: C

Explanation

The correct answer is C because the GDPR applies to the processing of personal data by a controller based in the EU, regardless of where the data processing takes place. Options A and D are incorrect as they suggest that the citizenship or targeting of individuals would dictate GDPR applicability, while option B is wrong since the location of processing in Spain does not override the controller's location in France.