Skip to main content
Praxikon
Agent check

Article 3: Territorial scope

Praxikon tracks Article 3 (Territorial scope) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IIn force since 25-05-2018

Official text

/
This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.
This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

More case law, guidelines and fines

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (4)

  • 24 September 2019 · C-507/17 · CJEU
    Google v CNIL

    A search engine need not de-reference results worldwide, but must do so on the versions for all Member States, with measures that discourage access from within the Union where needed.

  • 28 July 2016 · C-191/15 · CJEUDirective 95/46
    VKI v Amazon

    An online shop targeting a Member State only falls under that state's data protection law if the processing takes place in the context of the activities of an establishment there.

  • 1 October 2015 · C-230/14 · CJEUDirective 95/46
    Weltimmo

    The concept of establishment is broad: a real and effective activity through stable arrangements is enough, even a minimal one. A supervisory authority may examine complaints but cannot impose penalties outside the scope of its own national law.

  • 13 May 2014 · C-131/12 · CJEUDirective 95/46
    Google Spain

    A search engine processes personal data as a controller and falls under EU law through a sales establishment in a Member State. Data subjects can ask for results on their name to be removed, the origin of the right to be forgotten.

Guidelines (1)

Line of case lawScope

When does the GDPR apply, also outside the EU, and what does the household exemption cover?

  1. Lindqvist (2003)Publishing on the internet is not a household activity.
  2. Google Spain (2014)A sales establishment in the EU brings the processing under EU law.
  3. Ryneš (2014)A camera filming the public road is not covered by the exemption.
  4. Weltimmo (2015)A minimal but real activity is already an establishment.
  5. Jehovan todistajat (2018)Door-to-door preaching is not a personal activity.
  6. Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) (2019)The EDPB works out the establishment and targeting criteria.
  7. Google v CNIL (2019)De-referencing applies across the EU.
  8. Österreichische Datenschutzbehörde (committee of inquiry) (2024)A parliamentary committee of inquiry also falls under the GDPR.

Checked on 5 November 2026

← Art. 2: Material scopeArt. 4: Definitions →

Connections

What connects to Article 3 GDPR

Guidelines