EDPB provides clarification on “main establishment”

EDPB provides clarification on “main establishment”

The EDPB has issued some guidance on the meaning of “main establishment” for the purposes of the one-stop-shop mechanism as follows:

  1. a controller’s “place of central administration” in the EU can be considered as a main establishment only if it takes the decisions on the purposes and means of the processing of personal data and it has power to have these decisions implemented.
  2. the one-stop-shop mechanism can only apply if there is evidence that one of the establishments in the EU takes the decisions on the purposes and means for the relevant processing operations and has the power to have such decisions implemented.

Whilst the place of central administration can be a start for the assessment of main establishment, it is clear that more is needed.

The opinion reinforces the importance of taking an objective rather than a subjective view on the question of where an organisation’s main establishment is located. Regulators have the ability to challenge the decision, which could cause significant disruption.

The full opinion can be found here.

If you would like assistance in considering the location of the main establishment of your organisation, please get in touch.


Don't just take our word for it