# Territorial scope — GDPR — context bundle > Focused context for a single provision, curated from overview.legal on 2026-08-22. Canonical page: https://overview.legal/laws/gdpr/art-3 > Every item cites its source. Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it. ## Provision ### Territorial scope — Territorial scope *GDPR, gdpr-art-3-en — https://overview.legal/laws/gdpr/art-3* 1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or b) the monitoring of their behaviour as far as their behaviour takes place within the Union. 3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law. ## Enforcement 4 decision(s) on record cite Article 3, totalling approximately €2,160,900 in fines (median €158,000). Top fines: - **Italian DPA sanctions Lusha Systems for processing contact data without consent in B2B** (Italy, €2,000,000) — https://overview.legal/posts/184678 - **Italian DPA finds GDPR applies to US-based Character.AI service** (Italy, €158,000) — https://overview.legal/posts/108999 - **Vodafone România SA: Insufficient technical and organisational measures to ensure information security** (ROMANIA, €2,900) — https://overview.legal/posts/47013 ## Guidance ### Opinion 13/2026 on the draft decision of the Office of the Data Protection Ombudsman (FI SA) regarding the approval of the requirement for accreditation of a certification body pursuant to Article 43(3) GDPR *EDPB — https://overview.legal/posts/125674* Opinion 13 /2026 on the draft decision of the Office of the Data Protection Ombudsman (FI SA) regarding the approval of the requirement for accreditation of a certification body pursuant to Article 43(3) GDPR Adopted on 15 April 2026 1 | Adopted 2 | Adopted The European Data Protection Board has adopted the following statement: Having regard to Article 43(3), 63, Article 64 (1)(c) and Article 64(3) - (8) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016… ### Opinion 14/2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal pursuant to Article 42.5 GDPR *EDPB — https://overview.legal/posts/125682* Opinion 14 / 2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal pursuant to Article 42.5 GDPR Adopted on 15 April 2026 1 | Adopted 2 | Adopted The European Data Protection Board Having regard to Article 63, Article 64 (2) and Article 42 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free… ### Opinion 34/2025 on the draft decision of the Greek Supervisory Authority regarding C.E.C.L certification criteria *EDPB — https://overview.legal/posts/51416* Adopted Opinion 34/ 2025 on the draft decision of the Greek Supervisory Authority regarding C.E.C.L certification criteria Adopted on 02 December 2025 1 | Adopted 2 | Adopted The European Data Protection Board Having regard to Article 63, Article 64(1)(c) and Article 42 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and… ### Guidelines 02/2024 on Article 48 GDPR *EDPB — https://overview.legal/posts/38045* Article 48 GDPR provides that: ' Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State, without prejudice to other grounds for transfer... ### Guidelines 02/2024 on Article 48 GDPR *EDPB — https://overview.legal/posts/50894* Adopted Guidelines 02/2024 on Article 48 GDPR Version 2.1 Adopted on 4 June 2025 Adopted 2 Version history Version 1.0 2 December 2024 Adoption of the Guidelines for public consultation Version 2.0 4 June 2025 Adoption of the Guidelines after public consultation Version 2.1 20 June 2025 Improved resolution of Annex Adopted 3 EXECUTIVE SUMMARY Article 48 GDPR provides that: “ Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a… ## Related topics - **Territorial scope (GDPR)** — https://overview.legal/topics/territorial-scope ## Legal Framework --- Generated by overview.legal · https://overview.legal/laws/gdpr/art-3 · 2026-08-22