Analysis of the "Processing by Establishment in Jurisdiction" Factor

Processing by Establishment in Jurisdiction means that the law is applicable to the processing of personal data within the context of an establishment located within a specific jurisdiction, regardless of where the actual data processing takes place.

European Union (EU) - General Data Protection Regulation (GDPR)

GDPR Art.3(1)

• This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.
• Feature: The GDPR applies to any data processing conducted by EU-established entities, ensuring comprehensive protection of personal data managed by these entities even if the actual processing occurs outside the EU.

United Arab Emirates (UAE) - Federal Personal Data Protection Law (PDPL)

Federal PDPL Art. 1

• Establishment: Any company or sole proprietorship established inside or outside the State, including companies which the federal or local government partially or wholly owns or has a shareholding therein.
• Feature: The PDPL's scope extends to entities established both within and outside the UAE, emphasizing the law’s broad jurisdictional reach over entities with ties to the UAE, regardless of their physical location.

United States - California Consumer Privacy Act (CCPA)

CCPA Sec.1798.140 (d)(1)

• “Business” means a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers’ personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers’ personal information, that does business in the State of California, and that satisfies one or more of the following thresholds: had annual gross revenues in excess of twenty-five million dollars; annually buys, sells, or shares the personal information of 100,000 or more consumers or households; derives 50 percent or more of its annual revenues from selling or sharing consumers’ personal information.
• Feature: The CCPA applies to businesses with substantial operations or revenue from California residents, including those that collect significant amounts of personal data or derive a significant portion of revenue from data sales, thus emphasizing economic thresholds for applicability.