# Territorial scope 3(2) — GDPR — provision context

> Focused context for a single provision (3(2)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-3#par-2
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Territorial scope** (GDPR, full article: https://overview.legal/laws/gdpr/art-3).

## Provision text

### 3(2)

This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

## Topics on this provision

- **Processors** — https://overview.legal/topics/processors
  Entities that process data on behalf of controllers
- **Personal Data** — https://overview.legal/topics/persoonsgegevens
  Information relating to identified or identifiable natural persons
- **Processing** — https://overview.legal/topics/verwerking
  Any operation performed on personal data
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing
- **Territorial scope (GDPR)** — https://overview.legal/topics/territorial-scope
  When the GDPR applies geographically: establishment in the Union, targeting (offering goods or services), and behavioural monitoring by non-EU controllers (Arti

## Cited by (exact-provision citations)

- **Judgment of the Court (Grand Chamber) of 4 October 2024.#C.G. v Bezirkshauptmannschaft Landeck.#Request for a preliminary ruling from the Landesverwaltungsgericht Tirol.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences – Directive (EU) 2016/680 – Article 3(2) – Concept of ‘processing’ – Article 4 – Principles re** (case-law) — https://overview.legal/posts/132164
- **Judgment of the Court (Eighth Chamber) of 5 October 2023.#RK v Ministerstvo zdravotnictví.#Request for a preliminary ruling from the Nejvyšší správní soud.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4(2) – Concept of ‘processing’ of personal data – Mobile application – Verification of the validity of ‘EU Digital COVID Certificates’ issued pursuant to Regulation (EU) 2021/953.#Case C-659/22** (case-law) — https://overview.legal/posts/132282
- **RYNES V. ÚŘAD PRO OCHRANU OSOBNICH ÚDAJŮ, 11.12.2014 (“RYNES”)** (case-law) — https://overview.legal/posts/6154
- **Judgment of the General Court (Tenth Chamber, Extended Composition) of 3 September 2025.#Philippe Latombe v European Commission.#Transfer of personal data to the United States – Commission Implementing Decision on the adequate level of protection of personal data ensured by the United States – Right to an effective remedy – Right to private and family life – Decisions based solely on the automated processing of personal data – Security of the processing of personal data.#Case T-553/23.** (case-law) — https://overview.legal/posts/132137
- **Patrick Breyer v Bundesrepublik Deutschland** (case-law) — https://overview.legal/posts/51479
- **Privacy International v Secretary of State** (case-law) — https://overview.legal/posts/51481
- **Data Protection Commissioner v Facebook Ireland and Maximillian Schrems** (case-law) — https://overview.legal/posts/51470
- **LINDQUIST, 6.11.2003 (“LINDQUIST”)** (case-law) — https://overview.legal/posts/6193
- **CJEU - C-439/19 - Latvijas Republikas Saeima (Penalty points)** (case-law) — https://overview.legal/posts/108995
- **CJEU - C-582/14 - Breyer** (case-law) — https://overview.legal/posts/125655
- **RYNES V. ÚŘAD PRO OCHRANU OSOBNICH ÚDAJŮ, 11.12.2014 (“RYNES”)** (case-law) — https://overview.legal/posts/6155
- **Judgment of the Court (First Chamber) of 30 March 2023.#Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums.#Request for a preliminary ruling from the Verwaltungsgericht Wiesbaden.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 88(1) and (2) – Processing of data in the employment context – Regional school system – Teaching by videoconference due to the COVID-19 pandemic –** (case-law) — https://overview.legal/posts/132292

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-3#par-2 · 2026-08-22