Enterprise

An enterprise means a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity (Art. 4(18) GDPR). The definition mirrors EU competition law and is deliberately broad: a sole trader, a foundation running a hospital or a university spin-out all qualify.

The related concept of a group of undertakings, meaning a controlling undertaking and its controlled undertakings (Art. 4(19)), has three practical consequences. First, binding corporate rules under Art. 47 can only be used within a group of undertakings or group of enterprises engaged in a joint economic activity. Second, Recital 48 recognises a legitimate interest in transmitting personal data within a group for internal administrative purposes, which supports intra-group sharing of employee and client data. Third, administrative fines under Art. 83 are calculated on the total worldwide annual turnover of the "undertaking", which the Court of Justice (Deutsche Wohnen, C-807/21) has confirmed means the economic unit, potentially the whole group, not the individual legal entity.

For a biotech subsidiary of a US parent, or a CRO belonging to an international group, this means that the exposure to fines and the options for transfer mechanisms are assessed at group level, which argues for group-wide governance rather than entity-by-entity compliance.