My IT company develops software for a client in Germany, and we have access to their user database. Who is the "controller" and who is the "processor" in this case, and what is the difference in responsibility?

This is a classic outsourcing scenario, and it is important to clearly delineate the roles: <ul> <li aria-level="1">Your German customer is the Controller. He defines the purpose and means of the data processing (e.g. “collecting emails for the newsletter”). It has the main responsibility to the end users.</li> <li aria-level="1">Your Ukrainian IT company is the Processor (Processor). You process data on behalf of the controller.</li> </ul> Practical difference in responsibility: Your main obligation as a processor is to ensure the technical security of the data and to process it strictly according to the controller’s instructions. Your relationship should be formalised in a special document – the Data Processing Agreement (DPA). If you go beyond the guidelines (e.g. start using customer data for your own purposes), you yourself will become the controller for this operation and will be fully liable.

Is it necessary to obtain explicit consent (e.g. via a cookie banner) for absolutely all data processing? Are there other legal grounds?

No, consent is only one of six lawful bases for processing data. GDPR does not require consent for all of them. You may process data without consent if it is necessary for: <ol> <li aria-level="1">Fulfilment of a contract: You do not ask for consent to process a delivery address when a customer buys a product. This is necessary to fulfil the contract of sale.</li> <li aria-level="1">Fulfilment of a legal duty: For example, you are obliged to pass data to the tax authorities.</li> <li aria-level="1">Protecting the vital interests of a person: For example, passing medical data to doctors in the event of an accident.</li> <li aria-level="1">Performing tasks in the public interest.</li> <li aria-level="1">Legitimate Interests: This is a flexible basis, but it requires balance. For example, you can process IP addresses to protect your site from cyberattacks. However, your interests must not override the rights and freedoms of the user.</li> </ol> Consent is required for activities that are not critical, such as marketing mailings or the setting of analytical and advertising cookies

How exactly can European regulators impose a fine on a Ukrainian company that does not have an office or bank accounts in the EU?

While there may not be a direct “cross-border enforcement” mechanism, there are other equally effective leverage points: <ul> <li aria-level="1">Access blocking: The regulator may oblige internet service providers in the EU to block access to your site or service.</li> <li aria-level="1">Reputational losses: Information about infringements and fines is public, which can completely destroy the trust of European customers and partners.</li> <li aria-level="1">Pressure through partners: Your European partners (e.g. payment systems like Stripe or Adyen, banks, cloud service providers) may refuse to co-operate with you to avoid being embroiled in a scandal. This could effectively stop your business in the EU market.</li> <li aria-level="1">Appoint an EU representative: If you systematically handle EU data, the GDPR requires you to appoint an official representative in one of the EU countries. It is this representative who will be the point of contact for regulators and can be held accountable.</li> </ul>

I use popular services: Google Analytics, Mailchimp, AWS. Is their use a violation of GDPR, since the data is transferred outside the EU (for example, to the USA)?

Using these services is not an automatic violation, but requires you to take certain actions to legalise data transfer. The services themselves (Google, Mailchimp, Amazon) are GDPR-compliant, but it is your responsibility to set them up correctly. What you need to do: <ol> <li aria-level="1">Sign the Data Processing Addendum (DPA): All major services provide this agreement, which legally formalises your “controller-processor” relationship and contains data protection terms and conditions.</li> <li aria-level="1">Set up the service correctly: For example, enable IP anonymisation in Google Analytics. In Mailchimp, use double opt-in forms.</li> <li aria-level="1">Choose the right storage location: Some services, like AWS, allow you to choose your data centre. For EU customers, it is better to choose servers located in Europe (e.g. Frankfurt or Ireland).</li> <li aria-level="1">Inform users: In your Privacy Policy, you should clearly state which third-party services you use and provide links to their policies.</li> </ol>

How do I know if a user is an EU resident? What if an EU citizen is using my site from Ukraine or using a VPN?

GDPR protects the personal data of any natural person physically present in the EU, regardless of their nationality. <ul> <li aria-level="1">The main criterion is geolocation, not citizenship. If a German citizen lives and works in Kiev, their data collected in Ukraine is subject to Ukrainian law, not GDPR. However, if a tourist from Ukraine accessed your website while in Berlin, their data is protected by GDPR.</li> <li aria-level="1">How to determine? The most common way is to analyse the user’s IP address.</li> <li aria-level="1">What if it’s a VPN? You can’t control the use of a VPN. However, the main question GDPR asks is: is your business targeting the EU market? If you offer prices in euros, have a language version of your website for an EU country, and deliver in the EU, then you are deliberately targeting that market. In that case, you are obliged to comply with GDPR for all users who could potentially be from the EU, even if you can’t pinpoint their exact location.</li> </ul>

Blog

Privacy settings

Manage settings

Necessary

Marketing

Personalization

Analytics