# Territorial scope 3(1) — GDPR — provision context

> Focused context for a single provision (3(1)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-3#par-1
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Territorial scope** (GDPR, full article: https://overview.legal/laws/gdpr/art-3).

## Provision text

### 3(1)

This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.


## Topics on this provision

- **Processors** — https://overview.legal/topics/processors
  Entities that process data on behalf of controllers
- **Personal Data** — https://overview.legal/topics/persoonsgegevens
  Information relating to identified or identifiable natural persons
- **Processing** — https://overview.legal/topics/verwerking
  Any operation performed on personal data
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing

## Cited by (exact-provision citations)

- **Judgment of the Court (Eighth Chamber) of 5 October 2023.#RK v Ministerstvo zdravotnictví.#Request for a preliminary ruling from the Nejvyšší správní soud.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4(2) – Concept of ‘processing’ of personal data – Mobile application – Verification of the validity of ‘EU Digital COVID Certificates’ issued pursuant to Regulation (EU) 2021/953.#Case C-659/22** (case-law) — https://overview.legal/posts/132282
- **Judgment of the General Court (Eighth Chamber, Extended Composition) of 26 April 2023.#Single Resolution Board v European Data Protection Supervisor.#Protection of personal data – Procedure for granting compensation to shareholders and creditors following the resolution of a bank – Decision of the EDPS in which it found that the SRB failed to fulfil its obligations concerning the processing of personal data – Article 15(1)(d) of Regulation (EU) 2018/1725 – Concept of personal data – Article 3(1)** (case-law) — https://overview.legal/posts/132290
- **Judgment of the Court (First Chamber) of 4 September 2025.#European Data Protection Supervisor v Single Resolution Board.#Appeal – Protection of natural persons with regard to the processing of personal data – Procedure for granting compensation to shareholders and creditors of a banking institution following the resolution of that institution – Decision of the European Data Protection Supervisor finding that the Single Resolution Board failed to fulfil its obligations relating to the processing** (case-law) — https://overview.legal/posts/132136
- **Order of the General Court (Tenth Chamber) of 29 April 2025.#Meta Platforms Ireland Ltd v European Data Protection Board.#Action for annulment – Protection of personal data – Opinion of the European Data Protection Board on valid consent in the context of ‘consent or pay’ models implemented by large online platforms – Article 64(2) of Regulation (EU) 2016/679 – Act not open to challenge – Inadmissibility – Liability – Damage – Causal link – Action manifestly lacking any foundation in law.#Case T** (case-law) — https://overview.legal/posts/132144
- **BGH: Court must grant unredacted file access in compulsory auctions under Art. 6(1)(e)** (case-law) — https://overview.legal/posts/53110
- **RYNES V. ÚŘAD PRO OCHRANU OSOBNICH ÚDAJŮ, 11.12.2014 (“RYNES”)** (case-law) — https://overview.legal/posts/6155
- **Google LLC, venant aux droits de Google Inc. v Commission nationale de l’informatique et des libertés (CNIL)** (case-law) — https://overview.legal/posts/6125
- **LINDQUIST, 6.11.2003 (“LINDQUIST”)** (case-law) — https://overview.legal/posts/6195
- **LINDQUIST, 6.11.2003 (“LINDQUIST”)** (case-law) — https://overview.legal/posts/6194
- **Judgment of the General Court (Tenth Chamber, Extended Composition) of 3 September 2025.#Philippe Latombe v European Commission.#Transfer of personal data to the United States – Commission Implementing Decision on the adequate level of protection of personal data ensured by the United States – Right to an effective remedy – Right to private and family life – Decisions based solely on the automated processing of personal data – Security of the processing of personal data.#Case T-553/23.** (case-law) — https://overview.legal/posts/132137
- **TIETOSUOJAVALTUUTETTU [FINNISH DATA PROTECTION OMBUDSMAN] V. SATAKUNNAN MARKKINAPORSSI OY AND SATAMEDIA OY, 16.12.2008 (“SATAKUNNAN&SATAMEDIA”)** (case-law) — https://overview.legal/posts/6186
- **Judgment of the Court (Third Chamber) of 16 February 2023.#HYA and Othersprokuratura.#Request for a preliminary ruling from the Spetsializiran nakazatelen sad.#Reference for a preliminary ruling – Telecommunications sector – Processing of personal data and the protection of privacy – Directive 2002/58 – Article 15(1) – Restriction of the confidentiality of electronic communications – Judicial decision authorising the interception, recording and storage of telephone conversations of persons suspe** (case-law) — https://overview.legal/posts/132294

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-3#par-1 · 2026-08-22