GDPR Art. 3 EN
LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this article. Contains: the article text, related recitals, cases citing it, enforcement stats and top fines, guidance, and related topics. Everything links back to its source on overview.legal — legal information, not advice.

Territorial scope

Territorial scope (GDPR)
In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗
Version history 2
  • 2016-05-04in force CELEX 02016R0679-20160504
  • 2016-04-27 CELEX 32016R0679
  1. 1.

    This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.

    Processors Processing Controllers 153
  2. 2.

    This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

    Processors Personal Data Territorial scope (GDPR) 181
    1. a)
      the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
      Territorial scope (GDPR) Personal Data
    2. b)
      the monitoring of their behaviour as far as their behaviour takes place within the Union.
      Territorial scope (GDPR) Monitoring
  3. 3.

    This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.

    Personal Data Representatives Controllers 38

Enforcement

Cited in 4 fines totalling €2.2M

Top authority: 🇮🇹Garante per la protezione dei dati personali (Italy) (2) · median fine €158,000 · see all enforcement for Art. 3 →

Connections by provision

3(1) 133 Case Law 17 Guidance 3 Literature .md
Case Law 133
CE - 449212 Judgment of the Court (Grand Chamber) of 10 July 2018.#Proceedings brought by Tietosuojavaltuutettu.#Request for a preliminary ruling from the Korkein hallinto-oikeus.#Reference for a preliminary ruling — Protection of individuals with regard to the processing of personal data — Directive 95/46/EC — Scope of the directive — Article 3 — Data collected and processed by the members of a religious community in the course of their door-to-door preaching — Article 2(c) — Definition of a ‘personal data Cour Administrative - 49701C CJEU - C-398/15 - Manni Judgment of the Court (Second Chamber) of 19 October 2016.#Xabier Ormaetxea Garai and Bernardo Lorenzo Almendros v Administración del Estado.#Request for a preliminary ruling from the Tribunal Supremo.#Reference for a preliminary ruling — Electronic communications networks and services — Directive 2002/21/EC — Article 3 — Impartiality and independence of national regulatory authorities — Institutional reform — Merger of national regulatory authority with other regulatory authorities — Dismissal Judgment of the Court (Third Chamber) of 28 July 2016.#Verein für Konsumenteninformation v Amazon EU Sàrl.#Request for a preliminary ruling from the Oberster Gerichtshof.#Reference for a preliminary ruling — Judicial cooperation in civil matters — Regulations (EC) No 864/2007 and (EC) No 593/2008 — Consumer protection — Directive 93/13/EEC — Data protection — Directive 95/46/EC — Online sales contracts concluded with consumers resident in other Member States — Unfair terms — General terms and co Judgment of the Court (Third Chamber) of 11 December 2019.#TK v Asociaţia de Proprietari bloc M5A-ScaraA.#Request for a preliminary ruling from the Tribunalul Bucureşti.#Reference for a preliminary ruling — Protection of individuals with regard to the processing of personal data — Charter of Fundamental Rights of the European Union — Articles 7 and 8 — Directive 95/46/EC — Article 6(1)(c) and Article 7(f) — Making the processing of personal data legitimate — National legislation allowing video s Judgment of the General Court (Fourth Chamber) of 20 July 2016 (Extracts).#Athanassios Oikonomopoulos v European Commission.#Non-contractual liability — Damage caused by the Commission in the context of an OLAF investigation and by OLAF — Actions for damages — Action for a declaration that certain measures taken by OLAF were void and inadmissible for evidentiary purposes before the national authorities — Admissibility — Misuse of powers — Processing of personal data — Rights of the defence.#Case +125 more
Guidance 17
Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s) Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) EDPB Annual Report 2018 Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) +9 more
Literature 3
Generative AI and data protection Perspectives for Open Source AI If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation
3(2) 132 Case Law 46 Guidance 3 Literature .md
Case Law 132
RYNES V. ÚŘAD PRO OCHRANU OSOBNICH ÚDAJŮ, 11.12.2014 (“RYNES”) RYNES V. ÚŘAD PRO OCHRANU OSOBNICH ÚDAJŮ, 11.12.2014 (“RYNES”) Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers Judgment of the Court (Grand Chamber) of 10 July 2018.#Proceedings brought by Tietosuojavaltuutettu.#Request for a preliminary ruling from the Korkein hallinto-oikeus.#Reference for a preliminary ruling — Protection of individuals with regard to the processing of personal data — Directive 95/46/EC — Scope of the directive — Article 3 — Data collected and processed by the members of a religious community in the course of their door-to-door preaching — Article 2(c) — Definition of a ‘personal data Judgment of the Court (Grand Chamber) of 2 October 2018.#Proceedings brought by Ministerio Fiscal.#Request for a preliminary ruling from the Audiencia Provincial de Tarragona.#Reference for a preliminary ruling — Electronic communications — Processing of personal data — Directive 2002/58/EC — Articles 1 and 3 — Scope — Confidentiality of electronic communications — Protection — Article 5 and Article 15(1) — Charter of Fundamental Rights of the European Union — Articles 7 and 8 — Data processed i CJEU - C-439/19 - Latvijas Republikas Saeima (Penalty points) Judgment of the Court (Grand Chamber) of 21 December 2016.#Tele2 Sverige AB v Post- och telestyrelsen and Secretary of State for the Home Department v Tom Watson and Others.#Requests for a preliminary ruling from the Kammarrätten i Stockholm and the Court of Appeal (England & Wales) (Civil Division).#Reference for a preliminary ruling — Electronic communications — Processing of personal data — Confidentiality of electronic communications — Protection — Directive 2002/58/EC — Articles 5, 6 and 9 Judgment of the Court (Third Chamber) of 28 July 2016.#Verein für Konsumenteninformation v Amazon EU Sàrl.#Request for a preliminary ruling from the Oberster Gerichtshof.#Reference for a preliminary ruling — Judicial cooperation in civil matters — Regulations (EC) No 864/2007 and (EC) No 593/2008 — Consumer protection — Directive 93/13/EEC — Data protection — Directive 95/46/EC — Online sales contracts concluded with consumers resident in other Member States — Unfair terms — General terms and co +124 more
Guidance 46
Opinion 15/2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal to be used as tool for transfers pursuant to Articles 42 and 46 GDPR EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 Opinion 14/2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal pursuant to Article 42.5 GDPR Opinion 7/2024 on the draft decision of the German North Rhine Westphalia Supervisory Authority regarding the EU Cloud Service Data Protection (Auditor) certification criteria Guidelines 9/2022 on personal data breach notification under GDPR Guidelines 03/2021 on the application of Article 65(1)(a) GDPR EDPB-EDPS Joint Opinion 04/2021 on the Proposal for a Regulation of the European Parliament and of the Council on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority +38 more
Literature 3
If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Generative AI and data protection General Data Protection Regulation (GDPR) – Revolution Coming to European Data Protection Laws in 2018. What’s New for Ordinary Citizens?
3(2)(a) 2 Case Law 4 Guidance .md
Case Law 2
Judgment of the Court (Fifth Chamber) of 10 March 2016.#Safe Interenvios, SA v Liberbank, SA and Others.#Request for a preliminary ruling from the Audiencia Provincial de Barcelona.#Reference for a preliminary ruling — Prevention of the use of the financial system for the purpose of money laundering and terrorist financing — Directive 2005/60/EC — Customer due diligence measures — Directive 2007/64/EC — Payment services in the internal market.#Case C-235/14. ¶11 Judgment of the Court (Fifth Chamber) of 10 March 2016.#Safe Interenvios, SA v Liberbank, SA and Others.#Request for a preliminary ruling from the Audiencia Provincial de Barcelona.#Reference for a preliminary ruling — Prevention of the use of the financial system for the purpose of money laundering and terrorist financing — Directive 2005/60/EC — Customer due diligence measures — Directive 2007/64/EC — Payment services in the internal market.#Case C-235/14.
Guidance 4
Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act)
3(2)(b) 1 Guidance .md
Guidance 1
Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)
3(3) 23 Case Law 14 Guidance 1 Literature .md
Case Law 23
Judgment of the Court (Third Chamber), 7 November 2013.#Institut professionnel des agents immobiliers (IPI) v Geoffrey Englebert and Others.#Request for a preliminary ruling from the Cour constitutionnelle (Belgium).#Processing of personal data — Directive 95/46/EC — Articles 10 and 11 — Obligation to inform — Article 13(1)(d) and (g) — Exceptions — Scope of exceptions — Private detectives acting for the supervisory body of a regulated profession — Directive 2002/58/EC — Article 15(1).#Case C‑47 VOLKER UND MARKUS SCHECKE GBR V. LAND HESSEN, EIFERT V. LAND HESSEN AND BUNDESANSTALT FUR LANDWIRTSCHAFT UND ERNAHRUNG, 9.Nov.2010 (“SCHECKE”) Judgment of the Court (Third Chamber) of 28 July 2016.#Verein für Konsumenteninformation v Amazon EU Sàrl.#Request for a preliminary ruling from the Oberster Gerichtshof.#Reference for a preliminary ruling — Judicial cooperation in civil matters — Regulations (EC) No 864/2007 and (EC) No 593/2008 — Consumer protection — Directive 93/13/EEC — Data protection — Directive 95/46/EC — Online sales contracts concluded with consumers resident in other Member States — Unfair terms — General terms and co CJEU - C-398/15 - Manni CJEU C-473/12 IPI: Member States need not transpose all Directive 95/46 Article 13 Judgment of the Court (Grand Chamber) of 6 October 2020.#État luxembourgeois v B and Others.#Requests for a preliminary ruling from the Cour administrative (Luxembourg).#References for a preliminary ruling – Directive 2011/16/EU – Administrative cooperation in the field of taxation – Articles 1 and 5 – Decision ordering that information be provided to the competent authority of a Member State, acting in response to a request for exchange of information from the competent authority of another Mem GC - T-318/24 Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers +15 more
Guidance 14
Guidelines 03/2021 on the application of Article 65(1)(a) GDPR EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) Guidelines 9/2022 on personal data breach notification under GDPR EDPB-EDPS Joint Opinion 1/2019 on the processing of patients’ data and the role of the European Commission within the eHealth Digital Service Infrastructure (eHDSI) EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR Guidelines 02/2022 on the application of Article 60 GDPR +6 more
Literature 1
If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation

Related across sources

Enforcement Italian DPA sanctions Lusha Systems for processing contact data without consent in B2B Literature Perspectives for Open Source AI Guidance Opinion 13/2026 on the draft decision of the Office of the Data Protection Ombudsman (FI SA) regarding the approval of the requirement for accreditation of a certification body pursuant to Article 43(3) GDPR Guidance Opinion 14/2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal pursuant to Article 42.5 GDPR Guidance Opinion 34/2025 on the draft decision of the Greek Supervisory Authority regarding C.E.C.L certification criteria Enforcement AEPD sanctions 23andMe for security failures in credential-stuffing breach