1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.
Article 3 GDPR - Territorial scope
2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.
Relevant Recitals
- Recital 22 Processing by an Establishment
- Recital 23 Applicable to Controllers/Processors Not Established in the Union if Data Subjects Within the Union are Targeted
- Recital 24 Applicable to Controllers/Processors Not Established in the Union if Data Subjects Within the Union are Profiled
- Recital 25 Applicable to Controllers Due to International Law
Frequently Asked Questions
Short answers to common questions about this provision. They are general information and not legal advice.
It applies in three situations. Paragraph 1 covers processing in the context of the activities of an establishment of a controller or processor in the Union, paragraph 2 covers controllers and processors outside the Union that target or monitor data subjects who are in the Union, and paragraph 3 covers controllers established in a place where Member State law applies by virtue of public international law.
No. Paragraph 1 applies regardless of whether the processing takes place in the Union or not. What matters is that the processing occurs in the context of the activities of a Union establishment, so a controller whose Union office is inextricably linked to processing carried out on servers elsewhere is fully within scope.
When its processing activities are related to the offering of goods or services to data subjects who are in the Union, irrespective of whether payment is required. Recital 23 points to factors such as the use of a Union language or currency and the mention of Union customers as evidence that the controller envisages offering goods or services to persons in the Union, whereas mere accessibility of a website is not enough.
The provision captures processing by a controller or processor not established in the Union that is related to the monitoring of the behaviour of data subjects, as far as that behaviour takes place within the Union. Recital 24 indicates that this includes tracking individuals on the internet, in particular to profile them for the purpose of analysing or predicting personal preferences, behaviours and attitudes.
No. Paragraph 2 refers to data subjects who are in the Union, a criterion of physical presence rather than nationality or residence. Conversely, under paragraph 1 the Regulation protects any data subject, wherever located, once the processing occurs in the context of the activities of a Union establishment.