# Definitions 4(23) — GDPR — provision context

> Focused context for a single provision (4(23)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-4#par-23
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Definitions** (GDPR, full article: https://overview.legal/laws/gdpr/art-4).

## Provision text

### 4(23)

‘cross-border processing’ means either:

a) processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or
b) processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

## Cited by (exact-provision citations)

- **Google LLC v CNIL** (case-law) — https://overview.legal/posts/51476
- **Meta Platforms v noyb** (case-law) — https://overview.legal/posts/51484
- **Meta Platforms v noyb** ¶40 (case-law, CJEU) — https://overview.legal/posts/51484
- **Google LLC, venant aux droits de Google Inc. v Commission nationale de l’informatique et des libertés (CNIL)** ¶15 (case-law, CJEU) — https://overview.legal/posts/5947
- **Guidelines 9/2022 on personal data breach notification under GDPR** (guidance) — https://overview.legal/posts/38058
- **Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority** (guidance) — https://overview.legal/posts/38046
- **Guidelines 02/2022 on the application of Article 60 GDPR** (guidance) — https://overview.legal/posts/38066
- **Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679** (guidance) — https://overview.legal/posts/38051
- **Opinion 04/2024 on the notion of main establishment of a controller in the Union under Art. 4.16(a) GDPR** (guidance) — https://overview.legal/posts/125773
- **EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679** (guidance) — https://overview.legal/posts/125829
- **Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority** §4 (guidance, EDPB) — https://overview.legal/posts/38046
- **Guidelines 02/2022 on the application of Article 60 GDPR** §8 (guidance, EDPB) — https://overview.legal/posts/38066

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-4#par-23 · 2026-08-22