The information controller decides the uses for which as well as usually means by which personal information is processed. Your business is service company dependent outdoors the EU. It provides services to customers outside the house the EU. Its clients can use its services whenever they journey to other nations, https://www.nathanlabsadvisory.com/blog/tag/information-security-policy/