Topic
Territorial scope (GDPR)
Follow topic LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this topic. Contains: the overview, key law text, case law, enforcement and guidance for this topic. Everything links back to its source on overview.legal — legal information, not advice.When the GDPR applies geographically: establishment in the Union, targeting (offering goods or services), and behavioural monitoring by non-EU controllers (Article 3 GDPR).
32 linked items 18 Laws6 Case Law6 Guidance1 News1 Literature
Everything on this topic, by type links go to the exact provision / paragraph / section
Laws 18
Art. 3(2) This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the U… GDPR Art. 3(2)(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or GDPR Art. 3(2)(b) the monitoring of their behaviour as far as their behaviour takes place within the Union. GDPR Art. 3(3) This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies… GDPR art 3 Territorial scope GDPR Apr 2016 art 27 Representatives of controllers or processors not established in the Union GDPR Apr 2016 rec 22 Recital 22 — extraterritorial scope of AI regulation AI Act Jun 2024 rec 80 Recital 80 GDPR Apr 2016 rec 25 Recital 25 GDPR Apr 2016 rec 82 Recital 82 AI Act Jun 2024 rec 114 Recital 114 NIS2 Dec 2022 rec 116 Recital 116 NIS2 Dec 2022 rec 113 Recital 113 NIS2 Dec 2022 rec 36 Recital 36 DSA Oct 2022 rec 123 Recital 123 DSA Oct 2022 rec 8 Recital 8 DSA Oct 2022 rec 31 Recital 31 DSA Oct 2022 rec 122 Recital 122 GDPR Apr 2016 rec 23 Recital 23 GDPR Apr 2016 rec 24 Recital 24 GDPR Apr 2016 rec 115 Recital 115 GDPR Apr 2016 rec 63 Recital 63 NIS2 Dec 2022 Case Law 6
¶13 May 2014, [Google Spain and Google ( C‑131/12 , EU:C:2014:317 ),] on the basis of the provisions of [Article 12(b) and subparagraph (a) of the first p… Google LLC, venant aux droits de Google Inc. v Commission nationale de l’informatique et des libertés (CNIL) ¶52 In the present case, it is apparent from the information provided in the order for reference, first, that Google’s establishment in French territory c… Google LLC, venant aux droits de Google Inc. v Commission nationale de l’informatique et des libertés (CNIL) ¶54 It is to be noted in this context that it is clear in particular from recitals 18 to 20 in the preamble to Directive 95/46 and Article 4 thereof that … GOOGLE SPAIN SL V. AEPD (THE DPA) & MARIO COSTEJA GONZALEZ, 13.May.2014 (“GOOGLE v. Spain”) ¶41 It follows from all the foregoing considerations that the answer to Question 2(a) and (b) is that Article 2(b) and (d) of Directive 95/46 are to be in… GOOGLE SPAIN SL V. AEPD (THE DPA) & MARIO COSTEJA GONZALEZ, 13.May.2014 (“GOOGLE v. Spain”) 507/17 Google LLC v CNIL CJEU Sep 2019 131/12 Google Spain SL and Google Inc. v AEPD and Mario Costeja González CJEU May 2014 CJEU Google LLC, venant aux droits de Google Inc. v Commission nationale de l’informatique et des libertés (CNIL) CJEU Sep 2019 CJEU UNABHäNGIGES LANDESZENTRUM FüR DATENSCHUTZ SCHLESWIG-HOLSTEIN v. WIRTSCHAFTSAKADEMIE SCHLESWIG-HOLDSTEIN GmbH CJEU Jun 2018 136/17 GC and Others v CNIL CJEU Sep 2019 CJEU GOOGLE SPAIN SL V. AEPD (THE DPA) & MARIO COSTEJA GONZALEZ, 13.May.2014 (“GOOGLE v. Spain”) CJEU May 2014 Guidance 6
guidelines on the territorial scope of the gdpr Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) EDPB Nov 2025 guidelines on the concepts of controller and processor in the gdpr Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Nov 2025 guidelines 022024 on article 48 gdpr Guidelines 02/2024 on Article 48 GDPR EDPB Nov 2025 guidelines on codes of conduct and monitoring bodies Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679 EDPB Nov 2025 guidelines on data subject rights right of access Guidelines 01/2022 on data subject rights - Right of access EDPB Nov 2025 guidelines on personal data breach notification under gdpr Guidelines 9/2022 on personal data breach notification under GDPR EDPB Nov 2025 News 1
IAPP Greek SA fines Clearview AI for EUR 20M IAPP Oct 2022 Literature 1
i-lex Perspectives for Open Source AI i-lex Jul 2026