GDPR Art. 3 EN
LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this article. Contains: the article text, related recitals, cases citing it, enforcement stats and top fines, guidance, and related topics. Everything links back to its source on overview.legal — legal information, not advice.

Territorial scope

Territorial scope (GDPR)
In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗
Version history 2
  • 2016-05-04in force CELEX 02016R0679-20160504
  • 2016-04-27 CELEX 32016R0679
  1. 1.

    This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.

    Processors Controllers Personal Data 137
  2. 2.

    This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

    Territorial scope (GDPR) Processors Controllers 174
    1. a)
      the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
      Territorial scope (GDPR) Personal Data
    2. b)
      the monitoring of their behaviour as far as their behaviour takes place within the Union.
      Territorial scope (GDPR) Monitoring
  3. 3.

    This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.

    Territorial scope (GDPR) Controllers Personal Data 45

Enforcement

Cited in 4 fines totalling €2.2M

Top authority: 🇮🇹Garante per la protezione dei dati personali (Italy) (2) · median fine €158,000 · see all enforcement for Art. 3 →

Connections by provision

3(1) 64 Case Law 5 Enforcement 65 Guidance 3 Literature .md
Case Law 64
Safe Interenvios, SA v Liberbank, SA and Others BGH - V ZB 90/25 European Data Protection Supervisor v Single Resolution Board Robert Roos and Others v European Parliament CJEU: collecting, republishing and transferring already-published personal data is Ligue des droits humains ASBL v Conseil des ministres Google LLC, venant aux droits de Google Inc. v Commission nationale de l’informatique et des libertés (CNIL) WM and Sovim SA v Luxembourg Business Registers +56 more
Enforcement 5
Vodafone România SA: Insufficient technical and organisational measures to ensure information security EDPS: European Parliament is sole controller for COVID testing website and failed Persónuvernd (Iceland) - 2025010364 ¶34 EDPS: European Parliament is sole controller for COVID testing website and failed ¶22 Persónuvernd (Iceland) - 2025010364
Guidance 65
EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) EDPB Annual Report 2018 Statement 05/2021 on the Data Governance Act in light of the legislative developments EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation +57 more
Literature 3
If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Perspectives for Open Source AI Generative AI and data protection
3(2) 67 Case Law 9 Enforcement 95 Guidance 3 Literature .md
Case Law 67
VG Osnabrück - 7 A 170/24 Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA C.G. v Bezirkshauptmannschaft Landeck KPN BV v Autoriteit Consument en Markt (ACM) Xabier Ormaetxea Garai and Bernardo Lorenzo Almendros v Administración del Estado Philippe Latombe v European Commission Proceedings brought by Tietosuojavaltuutettu Robert Roos and Others v European Parliament +59 more
Enforcement 9
HDPA (Greece) - 7/2026 AEPD (Spain) - PS-00140-2025 Garante fines Lusha Systems Inc. over unauthorized B2B contact database Garante per la protezione dei dati personali (Italy) - 487/2026 ¶42 HDPA (Greece) - 7/2026 ¶45 AEPD (Spain) - PS-00140-2025 ¶15 Garante fines Lusha Systems Inc. over unauthorized B2B contact database ¶124 Garante fines Lusha Systems Inc. over unauthorized B2B contact database +1 more
Guidance 95
EDPB-EDPS Joint Opinion 04/2021 on the Proposal for a Regulation of the European Parliament and of the Council on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR Information note on data transfers under the GDPR to the United States after the adoption of the adequacy decision on 10 July 2023 Statement on the end of the Brexit transition period - update 13/01/2021 Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s) EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) Statement 4/2024 on the recent legislative developments on the Draft Regulation laying down additional procedural rules for the enforcement of the GDPR Translations proofread by EDPB Members. This language version has not yet been proofread. +87 more
Literature 3
If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation General Data Protection Regulation (GDPR) – Revolution Coming to European Data Protection Laws in 2018. What’s New for Ordinary Citizens? Generative AI and data protection
3(2)(a) 2 Case Law 18 Enforcement 12 Guidance .md
Case Law 2
Safe Interenvios, SA v Liberbank, SA and Others ¶11 Safe Interenvios, SA v Liberbank, SA and Others
Enforcement 18
Icelandic DPA: City of Reykjavik cannot request bank statements from NPA disabled service Garante per la protezione dei dati personali (Italy) - 487/2026 Garante fines Lusha Systems Inc. over unauthorized B2B contact database ¶19 Garante fines Lusha Systems Inc. over unauthorized B2B contact database ¶6 Garante fines Lusha Systems Inc. over unauthorized B2B contact database ¶169 Garante fines Lusha Systems Inc. over unauthorized B2B contact database ¶170 Garante fines Lusha Systems Inc. over unauthorized B2B contact database ¶171 Garante fines Lusha Systems Inc. over unauthorized B2B contact database +10 more
Guidance 12
Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR ¶45 Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) ¶40 EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) ¶27 EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse ¶72 Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) +4 more
3(2)(b) 13 Enforcement 4 Guidance .md
Enforcement 13
Garante fines Lusha Systems Inc. over unauthorized B2B contact database Icelandic DPA: City of Reykjavik cannot request bank statements from NPA disabled service ¶179 Garante fines Lusha Systems Inc. over unauthorized B2B contact database ¶180 Garante fines Lusha Systems Inc. over unauthorized B2B contact database ¶162 Garante fines Lusha Systems Inc. over unauthorized B2B contact database ¶20 Garante fines Lusha Systems Inc. over unauthorized B2B contact database ¶18 Icelandic DPA: City of Reykjavik cannot request bank statements from NPA disabled service ¶172 Garante fines Lusha Systems Inc. over unauthorized B2B contact database +5 more
Guidance 4
Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) ¶54 Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) ¶56 Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) ¶53 Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)
3(3) 20 Case Law 1 Enforcement 23 Guidance 1 Literature .md
Case Law 20
W. P. Willems and Others v Burgemeester van Nuth and Others CJEU - C-473/12 - IPI Ligue des droits humains ASBL v Conseil des ministres État luxembourgeois v B and Others Verein für Konsumenteninformation v Amazon EU Sàrl Judgment of the Court (Third Chamber), 7 November 2013.#Institut professionnel des agents immobiliers (IPI) v Geoffrey Englebert and Others.#Request for a preliminary ruling from the Cour constitutionnelle (Belgium).#Processing of personal data — Directive 95/46/EC — Articles 10 and 11 — Obligation to inform — Article 13(1)(d) and (g) — Exceptions — Scope of exceptions — Private detectives acting for the supervisory body of a regulated profession — Directive 2002/58/EC — Article 15(1).#Case C‑47 CJEU: Processing of beneficiary data not based on consent; individuals must be informed ¶23 État luxembourgeois v B and Others +12 more
Enforcement 1
Vodafone România SA: Insufficient technical and organisational measures to ensure information security
Guidance 23
EDPB-EDPS Joint Opinion 04/2021 on the Proposal for a Regulation of the European Parliament and of the Council on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 Guidelines 9/2022 on personal data breach notification under GDPR Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework ( EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision +15 more
Literature 1
If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation

Related across sources

C-507/17 Google LLC v CNIL C-507/17 (Google Territorial Scope) CJEU Sep 24, 2019 Territorial scope (GDPR) Right to be Forgotten Direct Marketing
Guidelines 3/2018 territorial scope of the GDPR (Article 3) Guidelines on the territorial scope of the GDPR Guidelines ·EDPB Nov 12, 2019 Territorial scope (GDPR) IP Address Processors
Google LLC, venant aux droits de Google Inc. v Commission nationale de l’informatique et des libertés (CNIL) Google - Global De-linking CJEU Sep 24, 2019 Territorial scope (GDPR) Personal Data Controllers
C-306/21 Komisia za zashtita na lichnite danni and Tsentralna izbiratelna komisia v Koalitsia „Demokratichna Bulgaria - Obedinenie“ In this preliminary ruling, the Court of Justice of the European Union addressed whether the GDPR applies to the processing of personal data during national and European elections… CJEU ·Eighth Chamber Oct 20, 2022 Material scope (GDPR) Supervision Personal Data
451423 French Supreme Court reviews CNIL €35M cookie consent fine against Amazon The French DPA had received a complaint on 28 May 2018 regarding the lawfulness of processing by Amazon Europe Core ('Provider' or 'The company'). The French DPA had forwarded… Supreme Administrative Court Jun 27, 2022 Consent Cookies Supervision
Guidelines 02/2024 Article 48 GDPR Article 48 GDPR provides that: ' Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to… Guidelines ·EDPB Jun 5, 2025 Controllers Privacy Shield International Transfer