A South African company may encounter the European Union’s General Data Protection Regulation (GDPR) through international customers, a European establishment or activities directed at individuals in the EU. But the GDPR does not automatically apply merely because a website can be viewed in Europe.
O’Reilly Law assists businesses with GDPR compliance assessments in South Africa, including practical reviews of contracting, data processing and cross-border exposure. Where EU-specific legal advice is necessary, we can work alongside appropriately qualified European counsel.
Under Article 3, the GDPR may apply to processing in the context of an EU establishment, or to certain processing by non-EU businesses offering goods or services to individuals in the EU or monitoring their behaviour there. A targeted assessment is essential; the fact that EU residents can visit a website is not, by itself, conclusive.
The regimes share many principles but differ in definitions, procedures, accountability obligations, notification rules and international transfer mechanisms. Existing POPIA policies are a useful foundation, not a substitute for checking applicable GDPR requirements.
We do not assume every South African company needs an EU representative or every business with an overseas customer falls under the GDPR. These questions depend on the statutory facts and available exceptions.
Not merely for that reason. Territorial scope involves an establishment analysis or relevant targeting or monitoring of people in the EU, assessed against Article 3 and regulatory guidance.
Not necessarily. The regimes overlap, but the GDPR contains distinct obligations and procedures. The applicable gaps should be reviewed.
Some non-EU organisations subject to Article 3(2) may need a representative under Article 27, subject to exceptions. An applicability assessment should address this specifically.
Article 28 requires particular contractual provisions when processing is undertaken by a processor on behalf of a controller. Whether those duties apply depends on the relationship and scope.
The contractual role and transfer direction matter. GDPR Chapter V may require appropriate transfer mechanisms for exports to countries outside the EEA.
We help South African businesses establish whether the GDPR applies, identify practical compliance priorities and review international commercial agreements.
Related: POPIA Compliance · Data & Privacy
This page is general information and not legal advice.
Please complete the following form to get in touch with us.
"*" indicates required fields
