EU GDPR and UK GDPR: identify the relevant activity

EU scope starts with facts

The European Commission explains that GDPR can apply to processing connected with an EU establishment and to certain offers or monitoring involving individuals in the EU by organisations outside it. Establish the actual connection rather than relying on nationality or a customer label.

European Commission: Application of the GDPR

Keep the UK review separate

The ICO describes UK DPO requirements by organisation and processing type, including certain large-scale core activities. Its DPO guidance is currently marked under review following the Data (Use and Access) Act; obtain current advice for the relevant UK question.

ICO: Data protection officers — guidance marked under review

Build a useful review brief

List entities, markets, processing purposes, customer instructions and cross-border flows. Collect notices, contracts, activity records and any existing appointment or representation arrangements.

• Identify which party decides each purpose.
• Distinguish statutory obligations from contractual promises.
• Record unknowns for the appropriately qualified reviewer.

Agree scope before delivery

A readiness discussion can identify questions and organise evidence. It does not establish EU or UK representation, regulator engagement or expertise for every local law.