Article 3 · Article 27 · Chapter V
A deliberate EU offering is likely to bring this processing into scope. This route separately identifies the transfer position for Taiwan and the supervisory context in Sweden.
Result on the selected facts
Article 3(2)(a) can apply to an organisation outside the EEA when the relevant processing relates to intentionally offering goods or services to people in the Union. Payment is not required. The conclusion should be tied to concrete targeting signals and the particular processing activity.
How the result was reached
The two countries provide context. The territorial conclusion changes because the connection, processing role, and risk facts change.
Article 3(2)(a) can apply to an organisation outside the EEA when the relevant processing relates to intentionally offering goods or services to people in the Union. Payment is not required. The conclusion should be tied to concrete targeting signals and the particular processing activity.
This scenario concerns administrators and business users and work identity, account permissions, product usage, support conversations, and billing-contact data. Separate customer-controller instructions from the provider’s own account, security, billing, and product-analytics purposes.
The organisation outside the EEA determines why and how this processing occurs. If Article 3 applies, it must map its own controller duties rather than relying on a customer or vendor to absorb them. For this B2B SaaS scenario, separate customer-controller instructions from the provider’s own account, security, billing, and product-analytics purposes.
The occasional-processing exception is unlikely to fit regular operations. If Article 3(2) applies and no EU establishment covers the activity, an Article 27 representative is likely required. For this Sweden scenario, confirm placement in an EU or EEA state where affected people are located and make the representative reachable to people and authorities.
Swedish product journeys, Sweden-specific campaigns, local delivery, local customer references, or deliberate onboarding of people in Sweden can support a targeting analysis. No single signal decides the question. Integritetsskyddsmyndigheten is the national data-protection authority for Sweden. Which authority is competent still depends on the processing, establishments, and cross-border cooperation rules.
Evidence file
A territorial-scope conclusion should be reproducible from recorded facts. It should not depend on an unrecorded impression that a business “feels European” or “feels foreign.”
Record the country-facing product, campaign, delivery, contract, language, onboarding, and customer evidence that demonstrates intentional direction.
Country-specific sales activity, EU contracts, local onboarding, and product access intentionally supplied to users in the selected Member State
Inventory work identity, account permissions, product usage, support conversations, and billing-contact data and identify which purposes belong to the controller.
Preserve the evidence supporting the “regular or continuing processing” classification and review it when scale, data, or purpose changes.
Record Sweden-specific contacts, complaints, campaigns, users, contracts, and language choices relevant to the territorial analysis.
Record whether the transfer to Taiwan uses adequacy, a qualifying certification, Standard Contractual Clauses, Binding Corporate Rules, or another valid Chapter V route.
Separate transfer result · No EU adequacy decision
The European Commission does not currently list Taiwan as an adequate destination. If an EU or EEA controller or processor discloses personal data to a separate recipient there, the parties normally need an Article 46 safeguard such as the Commission’s Standard Contractual Clauses or Binding Corporate Rules, plus the required transfer assessment and supplementary measures.
Territorial scope and an EU or EEA transfer to Taiwan are separate tests. Direct collection by a B2B SaaS provider based in Taiwan is not automatically the same event as an EU or EEA exporter disclosing data to a separate recipient there. Map every exporter, importer, controller role, and transfer mechanism separately.
Questions raised by these facts
No. Mere accessibility is not enough by itself. An EU establishment, an intentional offering of goods or services, or relevant monitoring can change the result.
No. The organisation outside the EEA determines why and how this processing occurs. If Article 3 applies, it must map its own controller duties rather than relying on a customer or vendor to absorb them.
The occasional-processing exception is unlikely to fit regular operations. If Article 3(2) applies and no EU establishment covers the activity, an Article 27 representative is likely required. For this Sweden scenario, confirm placement in an EU or EEA state where affected people are located and make the representative reachable to people and authorities.
Territorial scope and an EU or EEA transfer to Taiwan are separate tests. Direct collection by a B2B SaaS provider based in Taiwan is not automatically the same event as an EU or EEA exporter disclosing data to a separate recipient there. Map every exporter, importer, controller role, and transfer mechanism separately.
Primary material
This page is general information based on the selected facts. It cannot account for unselected establishments, processing activities, contracts, or national-law questions.
Use your complete facts
ProseID lets legal and compliance teams publish fixed interpretations, run them as guided workflows, and retain a version-bound record of each completed path.
Cookies & storage
Essential storage keeps you signed in and secure — it's always on. With your OK we'd also use analytics to see how the product is used and improve it; analytics only runs if you allow it. See our privacy policy.