Cruxi
Service decision and evidence guide
An EU processor does not automatically turn its overseas client into an EU-established controller. The EDPB example separates an EU processor’s own processing obligations from an overseas retailer’s scope where the retailer serves only its domestic market. Map the parties and targeting facts, then assess each activity and appointment independently.
Evidence retrieved 2026-10-07. Source versions and topic-specific limits are listed below.
Sourced criteria · EU · GDPR
| Decision or task | What the source describes | What to prepare |
|---|---|---|
| Controller and processor are assessed separately | The worked example has an overseas retailer serving its domestic customers and using a processor in the EU. The EU processor’s presence does not automatically establish the controller in the Union. [1] | Compare the stated example/criterion with the evidence tasks below; retain any factual differences. |
| The processor’s own scope | The guidance explains that processing in the context of the EU processor’s establishment has its own GDPR scope. This is not proof that every processing activity of its client is in scope. [1] | Compare the stated example/criterion with the evidence tasks below; retain any factual differences. |
| The processing contract | Article 28 sets conditions for controller–processor arrangements. Scope the contract and responsibilities separately from any Article 27 representative appointment. [3] [4] | Compare the stated example/criterion with the evidence tasks below; retain any factual differences. |
The EDPB document is Guidelines 3/2018, version 2.1, adopted 12 November 2019. Its worked examples are guidance and dated assumptions, not a new law or a conclusion about your organisation. EU scope is assessed here; UK and Swiss rules require separate evidence. Novel or disputed scope/role interpretations need specialist legal review.
Use this checklist to gather your business or product details before speaking with a specialist. The items below explain what to record and suggest useful supporting documents. You can add your own answers in the editable project brief.
Record which legal entity determines purposes/means and which acts on instructions; locate each relevant establishment.
Useful evidence: A controller/processor and establishment matrix.
Identify whether the overseas controller offers to people in the EU or monitors behaviour there, and which processor activities relate to that purpose.
Useful evidence: A purpose-level data-flow and targeting map.
Ask the provider for a scope conclusion for each party, a processing-contract review where relevant and a distinct representative assessment.
Useful evidence: Separate deliverables, responsible entities and unresolved scope questions.
Read the official document in context. The audit details identify the precise locators and preserved versions used for this page.
Guidelines 3/2018 version 2.1; 2020-01-07 formatting change · retrieved 2026-10-07
Source key D17 · snapshot d6910de864b8bbbdd7ed11e7509391a21ac9b627c8745dde87e8acd7c63b4862
Consolidated text dated 2016-05-04 · retrieved 2026-10-06
Source key D05 · snapshot 149156a8f8dfc90bead21c89c32eb84f92b7414602c3e00e058755810b48ef8a
Confirm the facts, scope and contact preference before sharing your project. Preparing this page sends no provider outreach.