--- title: "Art. 3 GDPR: Territorial scope" canonical: "https://dposchool.com/gdpr/article/3" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_3" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 3 GDPR · Chapter I: General provisions # Article 3 GDPR: Territorial scope Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) The Regulation applies to processing in the context of the activities of an establishment in the Union, wherever the processing takes place. It also applies to controllers and processors outside the Union when they offer goods or services to people in the Union or monitor their behaviour in the Union. ## Official text ### Article 3(1) **1.** This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. ### Article 3(2) **2.** This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: #### Article 3(2)(a) **(a)** the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or #### Article 3(2)(b) **(b)** the monitoring of their behaviour as far as their behaviour takes place within the Union. ### Article 3(3) **3.** This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 3 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_3) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 2](https://dposchool.com/gdpr/recital/2) - [Recital 5](https://dposchool.com/gdpr/recital/5) - [Recital 6](https://dposchool.com/gdpr/recital/6) ## Court of Justice judgments ### Related (earlier law or other instruments) #### [C-507/17, Google LLC, successor in law to Google Inc. v Commission nationale de l'informatique et des libertés (CNIL)](https://dposchool.com/gdpr/case/c-507-17) Judgment of 24 September 2019 · ECLI:EU:C:2019:772 Instrument: GDPR together with Directive 95/46 A search engine that grants delisting need not do so on all versions worldwide, but must do so on all EU versions and use measures to discourage EU users from reaching the links. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-507/17&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0507) #### [C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González](https://dposchool.com/gdpr/case/c-131-12) Judgment of 13 May 2014 · ECLI:EU:C:2014:317 Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR) A search engine operator processes personal data and is a controller for that processing; EU law applies where it has an establishment selling advertising in a Member State; and a person can ask it to remove links to information about them that is inadequate, irrelevant or no longer relevant, after a balancing of rights. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-131/12&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0131) ## EDPB guidance ### [Guidelines 05/2021 on the interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR](https://dposchool.com/gdpr/guidance/edpb-05-2021) EDPB 05/2021 · Final · First published 19 November 2021 · Final version 24 February 2023 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-052021-on-the-interplay-between-the-application-of-article-3-and-the_en) ### [Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)](https://dposchool.com/gdpr/guidance/edpb-03-2018) EDPB 03/2018 · Final · First published 23 November 2018 · Final version 12 November 2019 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-32018-on-the-territorial-scope-of-the-gdpr-article-3-version-adopted_en) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter I](https://dposchool.com/gdpr/chapter/1) / Article 3 Previous: [Art. 2 GDPR: Material scope](https://dposchool.com/gdpr/article/2) Next: [Art. 4 GDPR: Definitions](https://dposchool.com/gdpr/article/4) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents