A U.S. company can be subject to GDPR without ever setting foot in Europe. Here are the key facts.
Territorial scope is broader than location
If your management company or payroll operation handles personal data of any individual in the EU, UK, or EEA — a crew member, a vessel owner, a client — GDPR applies to that data, no matter where your company is registered.
Common triggers in yacht management
- Managing a vessel with an EU-based crew member on the crew list.
- Processing payroll for crew who are EU residents for tax or banking purposes.
- Storing certificates, medical records, or next-of-kin details of EU-resident crew.
- Having EU-based vessel owners or Clients whose data you hold in your MMV account.
Your role
In most of these cases, your organization is the Controller (you decide what personal data is collected and why), and MMV is a Processor acting on your instructions. Both roles have obligations. See Controller vs. Processor.
Sanctions can be significant
Fines can reach the greater of €20 million or 4% of worldwide annual turnover — meaning global revenue, not just EU revenue.
Related
Was this article helpful?
Questions about this document?
Contact your MMV account manager or open a support ticket.