The transnational reach of GDPR: a comprehensive framework that can regulate data privacy internationally, or is that unrealistic?

Within the European Union (EU) protection of one’s personal data is considered a fundamental right. It is enshrined in the Treaty on the Functioning of the European Union and the Charter of Fundamental Rights of the European Union. By 2011, the 1995 Data Protection Directive was considered outdated and unable to respond to the challenges to data protection created by modern technologies including the internet and social media. Therefore, the EU adopted the General Data Protection Regulation (GDPR) with the aim of bringing data protection into the 21st century. Data that relates to individuals within the EU is not always processed within the boundaries of the EU member states. The GDPR has tried to respond to this by purporting extraterritorial applicability and by providing extensive obligations on EU entities when transferring data outwith the EU. This research project examines how effective these measures are and, as a result, to what extent the GDPR has succeeded in its aim of being a comprehensive framework that can regulate data privacy internationally.