Art. 3 GDPR · Chapter I: General provisions
Article 3 GDPR: Territorial scope
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
The Regulation applies to processing in the context of the activities of an establishment in the Union, wherever the processing takes place. It also applies to controllers and processors outside the Union when they offer goods or services to people in the Union or monitor their behaviour in the Union.
Official text
This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.
This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
the monitoring of their behaviour as far as their behaviour takes place within the Union.
This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
Court of Justice judgments
Related (earlier law or other instruments)
- C-507/17, Google LLC, successor in law to Google Inc. v Commission nationale de l'informatique et des libertés (CNIL)
Judgment of 24 September 2019ECLI:EU:C:2019:772
Instrument: GDPR together with Directive 95/46
A search engine that grants delisting need not do so on all versions worldwide, but must do so on all EU versions and use measures to discourage EU users from reaching the links.
- C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González
Judgment of 13 May 2014ECLI:EU:C:2014:317
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
A search engine operator processes personal data and is a controller for that processing; EU law applies where it has an establishment selling advertising in a Member State; and a person can ask it to remove links to information about them that is inadequate, irrelevant or no longer relevant, after a balancing of rights.
EDPB guidance
- Guidelines 05/2021 on the interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR
EDPB 05/2021FinalFirst published 19 November 2021Final version 24 February 2023
- Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)
EDPB 03/2018FinalFirst published 23 November 2018Final version 12 November 2019