Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

What it covers

These guidelines interpret the territorial scope of the GDPR under Article 3, explaining the establishment criterion in Article 3(1) and the targeting criterion in Article 3(2), processing subject to Member State law by virtue of public international law, and the requirement to appoint an EU representative.

Why it matters

It is the primary reference for determining whether a controller or processor, particularly one based outside the EU, is subject to the GDPR for a given processing activity.

Refer to it when

• assessing whether a non-EU company falls within GDPR scope
• distinguishing establishment-based from targeting-based application
• deciding whether an EU representative must be appointed
• evaluating whether offering goods or services or monitoring behaviour triggers Article 3(2)

Questions this document addresses

• What constitutes an 'establishment' for the purposes of Article 3(1)?
• When does offering goods or services to data subjects in the Union trigger Article 3(2)?
• When does monitoring of behaviour bring processing within scope?
• When must a representative be appointed under Article 27 and what are its responsibilities?

Topics

• Territorial scope
• Controller & processor