Make your website GDPR compliant today — Cookiebot automates cookie consent, scanning, and compliance so you don't have to.
Try Cookiebot Free
Article 3
Territorial scope
Chapter 1|General Provisions|📖 3 min read
1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.
2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.
Understanding This Article
Article 3 establishes GDPR's territorial scope, defining where and to whom the regulation applies. This is one of the most significant provisions of the GDPR because it extends EU data protection law far beyond EU borders, creating what's known as the 'Brussels Effect' in global privacy regulation.
Paragraph 1 applies the 'establishment principle': if a controller or processor has an establishment anywhere in the EU, GDPR applies to all processing activities conducted in that establishment's context, even if the data is actually processed on servers in other countries. An 'establishment' means a real presence involving effective and real activity, not just a mailbox company. This is purposefully broad to prevent companies from evading GDPR by claiming their data processing happens elsewhere.
Paragraph 2 introduces the groundbreaking 'targeting principle' with two main triggers. First, under 2(a), GDPR applies to organizations outside the EU that offer goods or services to people in the EU - whether paid or free. The key is whether the offering is directed at EU residents (indicators include EU-specific marketing, EU languages, EU currencies, or EU domain names). Second, under 2(b), GDPR applies when monitoring the behavior of people located in the EU, such as through tracking cookies, profiling, or behavioral advertising.
Paragraph 3 covers the special case where Member State law applies extraterritorially under public international law, such as in embassies or on vessels flying an EU flag.
This broad territorial scope means that virtually any organization serving EU customers or monitoring EU residents must comply with GDPR, making it effectively a global standard for data protection.
Key Points
Applies to any organization with an establishment in the EU, regardless of where the actual data processing occurs
Has extraterritorial reach: non-EU organizations must comply when offering goods/services to EU residents or monitoring their behavior
Targeting matters: offering services specifically to EU residents triggers GDPR compliance obligations
Monitoring behavior in the EU (such as online tracking and profiling) brings non-EU entities under GDPR jurisdiction
Creates global compliance obligations for companies serving EU markets, making GDPR one of the world's most far-reaching privacy laws
Practical Application
EU Establishment Example: A US-based company with a subsidiary in Ireland that handles EU customer data must comply with GDPR for all processing related to that establishment, even if the actual servers are in the United States. Google, Facebook, and other tech giants have EU establishments and thus fall under GDPR.
Offering Goods/Services Example: An Australian e-commerce retailer that ships products to EU customers and displays prices in euros with EU-specific marketing campaigns must comply with GDPR, even without any physical presence in Europe. However, a local Australian shop that coincidentally ships to an EU tourist doesn't necessarily fall under GDPR if not specifically targeting EU residents.
Behavioral Monitoring Example: A Chinese social media platform that uses cookies to track the browsing behavior of EU users for advertising purposes must comply with GDPR, even if the platform isn't specifically marketed to EU residents. Online tracking and profiling of EU users is a key trigger for GDPR applicability.
No GDPR Application Examples: A Japanese restaurant's website in Japanese only, serving only local customers, wouldn't fall under GDPR even if an EU tourist happens to visit. A Brazilian bank serving only Brazilian customers, without targeting EU residents, also wouldn't be subject to GDPR.
Practical Compliance: Companies need to assess whether they have EU establishments or are targeting/monitoring EU residents. If yes, they need to appoint an EU representative (if not established in the EU), comply with all GDPR obligations, and be prepared for enforcement by EU supervisory authorities.