Question

A retail company headquartered in Brazil operates only physical stores domestically but launches a new e-commerce website that ships internationally and accepts orders from customers located in the European Union. The privacy officer is determining which legal obligations now apply to the company's processing activities. Which of the following BEST describes the company's regulatory exposure?

Accepted Answer

The GDPR applies to the processing of EU customers' personal data because the company is intentionally offering goods to individuals in the EU, in addition to LGPD obligations

Answer

Only Brazil's LGPD applies, because the company is headquartered and primarily operates in Brazil

Answer

No additional law applies until the company establishes a physical presence or subsidiary within the EU

Answer

The GDPR applies to all of the company's processing globally, superseding Brazil's LGPD for every customer