learn-gdpr-with-phoebe / Practitioner session 1 of 8
Learn GDPR with Phoebe · Practitioner track · Session 1 of 8

Does GDPR apply? Run the checker

Every GDPR project starts with one question: does it apply to us at all? This session turns Article 3 into a tool you can run in thirty seconds - a live checker that takes three answers and tells you whether the GDPR reaches you, which limb catches you, and what to do next. A second mode helps with the follow-on question: once you are in, which lawful basis fits. Lumina, a Singapore SaaS with EU customers, starts here.

🟢 Practitioner track DPOs · marketers · ops Live checker included Start here
0-3 · Welcome 3-18 · Concepts 18-40 · Build-along 40-45 · Q&A
Part 0

The question that gates everything else

There is no point choosing a lawful basis, writing a notice, or planning a breach response until you know the GDPR applies to you. Applicability is the gate. The good news: the test is small - three questions from Article 3 - and once you can run it, you can screen any product, market, or campaign in seconds. This session builds that reflex with a checker you drive yourself.

Read this first Educational, not legal advice. The checker is a teaching model of Articles 3 and 6 - always read the Regulation and get proper advice for a real situation, especially on close calls about whether you are "offering to" people in the EU.
Live - presented in session Self-study - full depth after class ★ Try it now Sources covered at the end
★ What you build today A fast, repeatable Article 3 applicability test, hands-on time with a live checker (applicability + lawful-basis modes), and a clear list of the first actions to take the moment the GDPR is found to apply.
Part 1 · covers the Article 3 test

Three questions, one answer 7 min live

The applicability test is a short decision: any one "yes" to the three Article 3 triggers means the GDPR applies. For a Singapore company the establishment question is usually "no" - so the answer turns on offering and monitoring.

Established in the EU? Offer goods/services to EU people? Monitor people in the EU? Any YES GDPR applies All NO likely out of scope yes no / no / no Out of scope is not permanent - the day you take an EU customer, re-run the test.
🔍 Click to zoom - the Article 3 applicability decision
LiveWhat each trigger really asks3 min▶
  • Established in the EU? An office, branch, or stable arrangement in the EU. Rare for a pure Singapore company, but if a subsidiary or a single employee's home office counts as stable, this can catch you.
  • Offer goods or services to people in the EU? The key word is target. A website merely being accessible from Europe is not enough; evidence of targeting - EU shipping, euro pricing, EU languages, marketing aimed at EU markets, actual EU customers - is. Payment is not required.
  • Monitor behaviour of people in the EU? Tracking, profiling, cookies-for-analytics, ad-tech that follows EU users. If your product observes what EU individuals do, this trigger is live.
The close call to flag "Are we offering to people in the EU" is the trigger people get wrong. Mere accessibility of your site does not count; targeting does. If you are unsure, that is exactly the point to get advice - it turns on evidence, not on whether a German could load your page.
LiveFound to be in scope? The first three actions3 min▶

"The GDPR applies" is a starting line, not a verdict. The moment the checker says yes, three actions follow:

  • Set a lawful basis for the EU personal data you already process (session b2). You cannot process lawfully without one of the six.
  • Appoint an EU representative (Art 27) if you have no EU establishment, unless a narrow exemption applies.
  • Start the record of processing (Art 30) - the inventory that every later obligation reads from (session b5).
Real world

Lumina runs the checker. Lumina answers no, yes, yes - no EU office, but it sells its SaaS to EU startups and runs product analytics on them. Two triggers, so the GDPR applies. Lumina's to-do list writes itself: a lawful basis for its EU users, an EU representative, and a record of processing. The rest of the practitioner track works through exactly that list.

Found in scope: three actions the checker hands you Lawful basis (b2) EU rep (Art 27) Record of processing IN SCOPE - ARTICLE 3(2)(A) Lumina: no EU office, yes sells to EU, yes runs analytics The moment the checker says yes, all three actions follow at once.
🔍 Click to zoom - in scope is a starting line, not a verdict
Part 2 · the live checker

Run it yourself 8 min live

The checker below has two modes. The applicability mode runs the Article 3 test; the lawful-basis mode helps with the follow-on question once you are in scope. Drive both.

Live★ Build-along: applicability3 min▶

Answer the three questions for Lumina (no, yes, yes) and watch the verdict cite Article 3(2)(a). Then flip a single answer to no and watch the reasoning change - the checker always names the limb that catches you.

Honesty note - what this checker is A teaching model of Article 3. It gives you the structure of the test, not a legal determination of your specific facts - especially the "offering to people in the EU" limb, which turns on evidence of targeting. Use it to screen and to learn; confirm real decisions with the Regulation and advice.
Live★ Build-along: which lawful basis3 min▶

Once you are in scope, every use of personal data needs one of the six lawful bases. Switch the checker to lawful-basis mode and pick a purpose - watch it suggest the fitting basis and flag the catch (consent must be a real opt-in; legitimate interests needs a balancing test; special-category data needs an Article 9 condition too).

Two bases teams reach for, and the flag that stacks on both What's the processing for? consumer marketing genuine business need special-category data CONSENT Consumer marketing purposes Real opt-in, withdrawable LEGITIMATE INTERESTS Genuine business need A documented balancing test + ARTICLE 9 CONDITION Special-category data Needed on top of any basis Consent and legitimate interests answer "which basis" - Article 9 answers "is that enough".
🔍 Click to zoom - special-category data needs a basis and an Article 9 condition, not either

Notice the two that trip teams up: consumer marketing pushes you toward consent (a real opt-in, withdrawable), while a genuine business need points to legitimate interests - which is flexible but only if you can show a documented balancing test. Session b2 makes this choice properly.

Self-studyWhy "out of scope" is a moving target2 min read▶

The most dangerous checker result is a "no" you treat as permanent. Applicability tracks what your business does, and that changes: a marketing push into Germany, a new EU reseller, a feature that profiles visitors, a single enterprise customer in Amsterdam - any of these flips a "no" to a "yes" without anyone re-running the test. Bake the Article 3 check into the moments where scope changes: entering a new market, launching analytics, onboarding a large customer. The checker is not a one-time gate; it is a screen you re-run whenever the answers to its three questions might have moved.

Build-along · take it further

Screen your real products ★ 10 min · the checker above

Run the applicability mode on the products and campaigns you actually operate.

Your main product. Answer the three triggers honestly. Record the verdict and the limb. If it is a "yes", write the first three actions next to it.

A borderline case. Take something you are unsure about - a site accessible from Europe but not targeted there. Note why "accessible" is not "offering", and mark it as a get-advice item rather than guessing.

Switch to basis mode. For one real processing purpose, see which basis the checker suggests and whether it flags a balancing test or an Article 9 condition. Is your current practice using that basis, or just assuming consent?

Reflect. In one line: which product most urgently needs GDPR work, and is it because it is in scope and unprepared? That is where the rest of the track pays off first.

★ Lumina after b1 Lumina knows it is in scope (Art 3(2)) and has its first three actions listed. Next, in b2, we do the first one properly: choose and document a lawful basis for its EU users - because "we have consent somewhere" is not a lawful basis you can defend.
Homework

Before session b2 ◐ 40 min total

Source material

Official sources covered

Taught from the GDPR text. This page covers ~80% of the working content on applicability - the deeper obligations follow in later sessions.

✓GDPR Article 3 (territorial scope)Part 1-2 · the three triggers as a runnable test
✓GDPR Article 6 (lawful bases)Part 2 · the six bases + the caveats (basis-mode checker)
◐GDPR Article 27 (EU representative)Part 1 · named as a first action; detail in the program session
Check yourself

Three questions before you go 🎯 ◐ 90 seconds

1 · How many of the three Article 3 triggers must be true for the GDPR to apply?

Any single trigger - establishment, offering to people in the EU, or monitoring them - brings you into scope. For a Singapore firm it usually turns on offering or monitoring.

2 · Your website is accessible from Germany but you do not target the EU. On the "offering" trigger, this...

Mere accessibility is not "offering". The trigger needs targeting evidence - EU shipping, euro pricing, EU-language marketing, actual EU customers. Close calls need advice.

3 · The checker says the GDPR applies. A sensible first action is...

In scope means you need a lawful basis for the EU data, likely an EU representative (Art 27), and a record of processing (Art 30) - the inventory the later obligations read from.

Practitioner session 1 cheat sheet · pin this

The Article 3 testEstablished in EU? Offering to people in EU? Monitoring people in EU? Any yes = in scope.
Accessibility ≠ offeringA site reachable from the EU is not "offering". The trigger needs evidence of targeting.
Person's locationThe test is whether the individual is in the EU - not nationality, not where you are.
First actions in scopeLawful basis for EU data · EU representative (Art 27) · record of processing (Art 30).
Six lawful basesConsent, contract, legal obligation, vital interests, public task, legitimate interests. Pick one, document it.
The basis trapsConsent = real opt-in, withdrawable. Legitimate interests = needs a balancing test. Special data = Art 9 too.
Out of scope movesRe-run the test on a new market, new analytics, or a big EU customer - a "no" can flip.
The checker is a modelIt teaches the test structure, not a legal ruling. Confirm close calls with advice.