Laws · GDPR ·art-3-par-2 EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
Full text
This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
How it connects
Cited by
- CJEU: Household exception is narrow; video surveillance covering public space is not
- CJEU: Camera image of identifiable person constitutes personal data
- Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority
- Guidelines 9/2022 on personal data breach notification under GDPR
- Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)
All 47
- Translations proofread by EDPB Members. This language version has not yet been proofread.
- Report on the use of SPE external experts in 2024
- Opinion 34/2025 on the draft decision of the Greek Supervisory Authority regarding C.E.C.L certification criteria
- If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation
- Generative AI and data protection
- Garante per la protezione dei dati personali (Italy) - 487/2026
- Rb. Noord-Holland - AWB-20 2618
- Opinion 15/2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal to be used as tool for transfers pursuant to Articles 42 and 46 GDPR
- Opinion 14/2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal pursuant to Article 42.5 GDPR
- Statement 4/2024 on the recent legislative developments on the Draft Regulation laying down additional procedural rules for the enforcement of the GDPR
- Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s)
- Guidelines 01/2023 on Article 37 Law Enforcement Directive
- Opinion 7/2024 on the draft decision of the German North Rhine Westphalia Supervisory Authority regarding the EU Cloud Service Data Protection (Auditor) certification criteria
- EDPB Article 97 GDPR application report: GDPR successful but improvements needed
- EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679
- Information note on data transfers under the GDPR to the United States after the adoption of the adequacy decision on 10 July 2023
- Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR
- EDPB Annual Report 2021
- EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act)
- EDPB-EDPS Joint Opinion 04/2021 on the Proposal for a Regulation of the European Parliament and of the Council on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery
- Statement on the end of the Brexit transition period - update 13/01/2021
- Statement on the end of the Brexit transition period
- EDPB Annual Report 2018
- Philippe Latombe v European Commission
- C.G. v Bezirkshauptmannschaft Landeck
- RK v Ministerstvo zdravotnictví
- OT v Vyriausioji tarnybinės etikos komisija
- Ligue des droits humains ASBL v Conseil des ministres
- Robert Roos and Others v European Parliament
- Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA
- Proceedings brought by Tietosuojavaltuutettu
- Peter Puškár v Finančné riaditeľstvo Slovenskej republiky and Kriminálny úrad finančnej správy
- Xabier Ormaetxea Garai and Bernardo Lorenzo Almendros v Administración del Estado
- KPN BV v Autoriteit Consument en Markt (ACM)
- Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy and Satamedia Oy
- General Data Protection Regulation (GDPR) – Revolution Coming to European Data Protection Laws in 2018. What’s New for Ordinary Citizens?
- AEPD (Spain) - PS-00140-2025
- Cour Administrative - 49701C
- HDPA (Greece) - 7/2026
- Garante fines Lusha Systems Inc. over unauthorized B2B contact database
- VG Osnabrück - 7 A 170/24
- European Commission v Hungary
Related across sources
C-507/17 Google LLC v CNIL C-507/17 (Google Territorial Scope) CJEU Sep 24, 2019 Territorial scope (GDPR) Right to be Forgotten Direct Marketing
C-306/21 Komisia za zashtita na lichnite danni and Tsentralna izbiratelna komisia v Koalitsia „Demokratichna Bulgaria - Obedinenie“ In this preliminary ruling, the Court of Justice of the European Union addressed whether the GDPR applies to the processing of personal data during national and European elections… CJEU ·Eighth Chamber Oct 20, 2022 Material scope (GDPR) Supervision Personal Data
Guidelines 3/2018 territorial scope of the GDPR (Article 3) Guidelines on the territorial scope of the GDPR Guidelines ·EDPB Nov 12, 2019 Territorial scope (GDPR) IP Address Processors
Opinion 22/2024 certain obligations following from the reliance on processor(s) and sub-processor(s) A dopted 1 Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub - processor(s) Adopted on 7 October 2024 Adopted 2 Executive summary The… Opinion ·EDPB Oct 9, 2024 Processors Controllers Processing Agreement
451423 French Supreme Court reviews CNIL €35M cookie consent fine against Amazon The French DPA had received a complaint on 28 May 2018 regarding the lawfulness of processing by Amazon Europe Core ('Provider' or 'The company'). The French DPA had forwarded… Supreme Administrative Court Jun 27, 2022 Consent Cookies Supervision
CJEU: Facebook's German ad sales establishment triggers GDPR territorial scope Territorial Scope / Concept of “establishment”: Facebook Germany is responsible for promoting and selling advertising space and carries on activities addressed to persons residing… Jun 5, 2018 Controllers Territorial scope (GDPR) Processors