On November 16th, 2018 The European Data Protection Board (EDPB) released draft Guidelines 3/2018 on the territorial scope of the GDPR

The document is out for public consultation and commentary until January 18, 2019. Canadian-based companies have had many questions concerning subjectivity to the GDPR. Even though a Canadian entity does not have a physical presence in the EU, the GDPR is extended to controllers and processors not established in the Union but that either:

• offer goods or services to EU data subjects or
• monitor their behavior which takes place in the EU

IAB Canada will be reviewing the guidelines carefully and provide our Policy & Regulatory Affairs Committee with a platform to provide commentary ahead of the January deadline.