GDPR Article 3: territorial scope

Article 3 is the first question in any GDPR analysis and the one most often answered by instinct. The instinct is usually "we are not in Europe, so it does not apply", and the Article has two separate routes that defeat it. This page sets out the official text of all three paragraphs and what each one actually turns on.

Article 3(1): the establishment test

The official consolidated text reads:

"This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not."

Three things are doing work here. First, "in the context of the activities of an establishment", not "by an establishment". The processing does not have to be performed by the European entity; it has to be connected to what that entity does. Second, the closing clause detaches the test from geography of processing entirely, so a European subsidiary's customer data processed on servers elsewhere is still inside Article 3(1). Third, the paragraph names both controllers and processors.

Article 3(1) has no reference to where the data subject is. A company established in the Union, processing in the context of that establishment's activities, is covered even where the individuals concerned are outside the Union.

Article 3(2): the two extraterritorial limbs

The text reads:

"This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

(b) the monitoring of their behaviour as far as their behaviour takes place within the Union."

The chapeau establishes the two preconditions: the data subjects are in the Union, and the controller or processor is not established in the Union. Then either limb suffices, as the "or" between them confirms.

Limb (a) settles a question that comes up constantly. "Irrespective of whether a payment of the data subject is required" means a free tier, a free trial, a newsletter or an ad-funded service all sit inside the wording. Charging nothing is not a defence.

Limb (b) is narrower than it first appears, because of the qualifier "as far as their behaviour takes place within the Union". The Regulation does not claim jurisdiction over everything you learn about a person who happens to be in the Union. It reaches the monitoring of behaviour occurring there.

Article 3(3): the public international law test

"This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law."

This is the residual paragraph, and it is short because it does little in commercial practice. It covers places such as Member State diplomatic missions and consular posts, and vessels or aircraft where Member State law applies by operation of public international law. Note that it names only a controller, not a processor, unlike paragraphs (1) and (2).

Why the distinction between 3(1) and 3(2) matters beyond scope

Getting the right paragraph is not an academic exercise, because a separate obligation hangs off Article 3(2) alone.

Article 27 requires a controller or processor to designate a representative in the Union where Article 3(2) applies to it, subject to the exemptions in Article 27(2). A company inside Article 3(1) has an establishment and does not need a representative. A company caught only by Article 3(2) may need one, and it is a public-facing appointment that has to be named in the privacy notice.

So the analysis has two outputs: whether the Regulation applies at all, and which compliance architecture follows.

The order to run the test in

Start with Article 3(1). If you have any entity, branch or stable arrangement in the Union and the processing relates to what it does, you are inside the Regulation and the enquiry into targeting and monitoring is unnecessary.

If you do not, move to Article 3(2) and treat the limbs separately. Ask whether the processing activities relate to offering goods or services to people in the Union, remembering that payment is irrelevant. Then ask, independently, whether they relate to monitoring behaviour taking place in the Union. Analytics, behavioural advertising, profiling and cross-site tracking are the usual candidates under limb (b), and a company can fail limb (a) cleanly while still being caught by limb (b).

Article 3(3) is a completeness check rather than a live question for most businesses.

What Article 3 does not decide

Scope is not the same as substance. Concluding that the Regulation applies tells you nothing about which lawful basis under Article 6 supports the processing, what the notice must say, or whether a transfer mechanism is needed. It only opens the door.

Equally, Article 3 does not resolve which supervisory authority is competent or whether the one-stop-shop mechanism is available. Those questions run through Articles 55 and 56 and often come out differently for a controller caught under 3(2) than for one caught under 3(1).

Next step