Laws · GDPR ·art-3-par-1 EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
Full text
This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.
How it connects
Cited by
- Google LLC, venant aux droits de Google Inc. v Commission nationale de l’informatique et des libertés (CNIL)
- CJEU: collecting, republishing and transferring already-published personal data is
- Lindqvist: Loading personal data onto a webpage constitutes processing under Directive
- Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)
- Vodafone România SA: Insufficient technical and organisational measures to ensure information security
All 44
- Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation
- Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation
- Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision
- BGH - V ZB 90/25
- EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (
- If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation
- Perspectives for Open Source AI
- Generative AI and data protection
- EDPS: European Parliament is sole controller for COVID testing website and failed
- Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models
- Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s)
- Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms
- EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679
- Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR
- EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse
- EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act)
- Statement 05/2021 on the Data Governance Act in light of the legislative developments
- EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act)
- EDPB Annual Report 2018
- Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities
- European Data Protection Supervisor v Single Resolution Board
- Philippe Latombe v European Commission
- RK v Ministerstvo zdravotnictví
- HYA and Othersprokuratura
- WM and Sovim SA v Luxembourg Business Registers
- Ligue des droits humains ASBL v Conseil des ministres
- Robert Roos and Others v European Parliament
- Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit
- État luxembourgeois v B and Others
- TK v Asociaţia de Proprietari bloc M5A-ScaraA
- Xabier Ormaetxea Garai and Bernardo Lorenzo Almendros v Administración del Estado
- Athanassios Oikonomopoulos v European Commission
- Safe Interenvios, SA v Liberbank, SA and Others
- Ireland v European Parliament and Council of the European Union
- Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy and Satamedia Oy
- OLG München - 36 U 1054/25 e
- BGH - VI ZR 97/22
- Persónuvernd (Iceland) - 2025010364
- European Commission v Hungary
Related across sources
14/2021 Cypriot court backs DPA fines of €40,000 each on football clubs and €25,000 on processor On 26 July 2021, a journalist informed the Cypriot DPA of a security vulnerability on an online platform. This online platform hosted ticket purchase sites of two Cypriot football… Administrative Court of Cyprus May 12, 2026 Controllers Processors Supervisory Authorities
Opinion 22/2024 certain obligations following from the reliance on processor(s) and sub-processor(s) A dopted 1 Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub - processor(s) Adopted on 7 October 2024 Adopted 2 Executive summary The… Opinion ·EDPB Oct 9, 2024 Processors Controllers Processing Agreement
Guidelines 07/2020 concepts of controller and processor in the GDPR Guidelines ·EDPB Jul 7, 2021 Controllers Processors IP Address
C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… CJEU ·Fifth Chamber May 4, 2023 Right to Restriction Right to be Forgotten Personal Data
C-46/23 Budapest Főváros IV. Kerület Újpest Önkormányzat Polgármesteri Hivatala v Nemzeti Adatvédelmi és Információszabadság Hatóság In a preliminary ruling requested by the Budapest High Court, the Court of Justice interpreted whether Article 58(2)(d) and (g) of the GDPR permits a national supervisory… CJEU ·Fifth Chamber Mar 14, 2024 Right to be Forgotten Personal Data Right to Restriction
S 5 SF 65/24 DS SG Nürnberg: MOVEit zero-day cyberattack via processor did not breach Art. 32 GDPR The data subject (a child born in 2018), represented by her parents, was insured with the controller (a statutory health insurance provider) and participated in its digital bonus… Social Court Nuremberg Jun 10, 2026 Processors Controllers Integrity and Confidentiality Principle