Decide whether a product, vendor, workflow, or data flow is inside GDPR scope before assigning notices, records, contracts, security controls, transfer safeguards, or data-subject rights work.
Use the test to record personal-data facts, controller and processor roles, EU establishment, EU targeting or monitoring, special-category and child-data flags, transfer branches, vendor dependencies, and evidence.
This GDPR applicability test applies when a team launches a product, changes telemetry, adds a vendor, opens an EU market, imports customer lists, processes employee or applicant data, or moves data outside the European Economic Area (EEA). The result should be a short evidence record that says whether GDPR applies to the specific processing activity and which follow-up branches are triggered.
Start with Article 2 and Article 4. GDPR scope begins with processing of by automated means, or non-automated personal data that forms or is intended to form part of a filing system. If the data cannot relate to an identified or identifiable natural person, record why the GDPR test stops at this step.
Do not treat the system name as the unit of analysis. Test each processing activity separately: collection, storage, enrichment, support access, analytics, disclosure to a vendor, model evaluation, deletion, and transfer can have different facts.
Sources (1)
Article 2 sets the material-scope test, and Article 4 defines personal data and processing for the first applicability step.
processing of personal data wholly or partly by automated means
After confirming , decide who determines the purposes and essential means of each processing activity. The European Data Protection Board (EDPB) describes controller, joint controller, and processor as functional roles, so contract labels are evidence but not the whole answer.
A product team can be a controller for its own analytics, a processor for customer-hosted data, and a separate controller for billing or security logs. Keep those role decisions separate, because each branch drives different Article 28 contracts, Article 30 records, notices, security obligations, and rights handling.
Sources (2)
Article 4 defines controller and processor, Article 26 covers joint controllers, and Article 28 covers processor processing under controller instructions.
determines the purposes and means
EDPB role guidance supports a factual role analysis based on the actual processing activity and allocation of responsibilities.
functional concepts
Use Article 3 as a separate territorial-scope test. GDPR can apply where processing is in the context of an EU establishment, even if processing occurs outside the Union. It can also apply to non-EU controllers or processors when processing relates to offering goods or services to data subjects in the Union or monitoring their behaviour there. Article 3(2) turns on where the person is during the relevant activity, not EU citizenship.
Record facts that show the link to the Union. For establishment, capture stable EU arrangements and how the processing is connected to those activities. For targeting, capture EU-facing offers such as language, currency, delivery, sales, signup, or service availability. For monitoring, capture tracking, profiling, behavioural analytics, location monitoring, health or lifestyle app telemetry, or similar observation of people in the Union. Article 3(3) separately covers a controller outside the Union in a place where Member State law applies by public international law, such as certain processing by a Member State embassy or consulate.
Sources (2)
Article 3 provides the establishment, targeting, monitoring, and public-international-law territorial-scope tests.
offering of goods or services
EDPB territorial-scope guidance explains Article 3 establishment, targeting, monitoring, and public-international-law criteria for controllers and processors inside and outside the EU.
particular processing activity
If GDPR applies, add risk and governance flags before routing the work. Special-category data, criminal-offence data, child consent in information-society services, large-scale processing, systematic monitoring, and high-risk processing can change the controls, review depth, and evidence needed.
The applicability record should not decide every downstream obligation. It should make the branching visible so privacy, product, security, procurement, support, HR, and data-governance owners know which workstream starts next.
Sources (1)
Articles 8, 9, 10, 25, 30, 32, and 35 support child-data, special-category, records, security, and DPIA routing flags.
special categories of personal data
Apply the EDPB's three cumulative transfer criteria before choosing a Chapter V mechanism: a controller or processor is subject to the GDPR for the processing; that exporter sends or otherwise makes available to a different controller, joint controller, or processor; and that importer is in a third country or is an international organisation. The importer's own Article 3 status does not remove the transfer. Article 44 also covers onward transfers, so follow hosted data, vendor support access, subprocessors, analytics pipelines, backups, and group-company access.
Remote access from a third country is not automatically a Chapter V transfer when the person accessing the data is an employee acting within the same controller rather than a different importer. The overseas access still requires GDPR security, purpose, access-control, and accountability review. If the employee makes the data available to a different controller or processor in the third country, the transfer test is met.
Use a transfer branch that starts with adequacy, then appropriate safeguards such as Commission standard contractual clauses, and then any Article 49 derogation only when the GDPR conditions are actually met. Do not treat a vendor's certificate, security questionnaire, or generic data processing agreement (DPA) as a substitute for the transfer mechanism and evidence.
Sources (4)
Chapter V sets the GDPR transfer rules, including the Article 44 general principle, Article 45 adequacy, and Article 46 appropriate safeguards.
transfers of personal data to third countries
Commission adequacy source for checking whether a third country, territory, sector, or international organisation has an adequacy decision.
adequacy decisions
Commission SCC source for transfer safeguards and role-based SCC modules under the GDPR.
pre-approved by the European Commission
Defines the EDPB's three cumulative transfer criteria and explains why access by an employee within the same controller is not a transfer to a different importer.
three cumulative criteria
The output of the test should be compact enough to review but specific enough to prove the decision later. Save the facts, not just the conclusion. If the answer is outside GDPR scope, the record should still show the personal-data, role, and territorial-scope facts that made the team stop.
Reopen the test when the product changes data categories, adds profiling or monitoring, enters an EU market, changes vendors, adds support access from a new country, changes controller or processor roles, launches a child-facing service, or begins a new transfer path.
Yes. A non-EU controller or processor can be in scope for a processing activity that relates to offering goods or services to people in the Union or monitoring their behaviour in the Union. Record the targeting or monitoring facts and check the Article 27 representative branch.
No. The contract is evidence, but the role test is factual. Decide who determines the purposes and essential means of the specific processing activity, then align the Article 28 contract, records, transfer evidence, and vendor controls with that role.
Keep the personal-data inventory, processing activity, role analysis, Article 3 territorial-scope facts, special-category and child-data flags, vendor and transfer branches, cited source URLs, owner approval, and reassessment trigger.
Sources (3)
GDPR source for the test's material scope, territorial scope, role definitions, records, representative, processor, and transfer evidence fields.
records of processing activities
EDPB guidance supports recording territorial-scope facts per processing activity, rather than treating a whole company as uniformly in or out of scope.
rather than a person
EDPB guidance supports the factual role record for controllers, processors, and joint controllers.
actual roles of the parties
Sorena can convert this GDPR applicability test into cited intake questions, owner assignments, vendor and transfer branches, evidence requests, and reassessment triggers for privacy, security, product, procurement, support, HR, and legal teams.
Ask questions tied to cited sources about GDPR material scope, territorial scope, role classification, transfer branches, and evidence using the cited sources on this page.
Review your GDPR applicability workflow, vendor branches, transfer evidence, and source gaps with Sorena.
"processing of personal data"
"processing of personal data wholly or partly by automated means"
"determines the purposes and means"
"offering of goods or services"
"special categories of personal data"
"transfers of personal data to third countries"
"records of processing activities"
"controller, joint controller and processor"
"functional concepts"
"actual roles of the parties"
"establishment criterion"
"particular processing activity"
"rather than a person"
"three cumulative criteria"
"adequacy decisions"
"Standard Contractual Clauses"
"pre-approved by the European Commission"
This GDPR Article 30 RoPA intake workflow helps capture controller and processor fields, owners, transfers, retention, security measures, and evidence before a processing activity goes live.
GDPR guide to profiling and Article 22 decisions: scope, transparency, lawful basis, DPIA triggers, safeguards, human intervention, challenge rights, and evidence.
EU GDPR breach notification workflow covering awareness, 72-hour supervisory authority notices, processor escalation, high-risk data-subject communication, delay reasons, and evidence logs.
A concrete EU GDPR breach notification workflow for detecting and triaging incidents, starting the awareness clock, assessing risk, notifying authorities or data subjects, and keeping Article 33 records.
This GDPR checklist helps review scope, lawful basis, notices, DSAR handling, DPIAs, RoPA, processor contracts, SCC transfers, breach notification, retention, security, and evidence.
GDPR guide to children's consent and special-category data: Article 8 national age variation, Article 9 conditions, transparency, DPIA triggers, safeguards, and evidence.
Practical EU GDPR compliance guide for mapping scope, lawful basis, notices, data-subject rights, DPIAs, RoPA, processor terms, breaches, transfers, retention, security, and penalties.
Classify GDPR controllers, processors, and joint controllers from actual decision-making, then document Article 26 allocation, Article 28 terms, instructions, and vendor evidence.
GDPR rights-request workflow for intake, identity checks, request scope, the one-month response clock, extensions, refusals, processor coordination, and evidence.
EU GDPR calendar for calculating rights-request deadlines, breach notification, DPIA and prior-consultation gates, transfer reviews, and retention checks.
Screen high-risk processing, run a GDPR Article 35 DPIA, record mitigation, and identify when Article 36 prior consultation is required.
EU GDPR DPIA guide covering Article 35 triggers and contents, CNIL and DPC PIA methods, residual risk, mitigation records, and prior consultation limits.
Run a GDPR DSAR workflow for intake, identity checks, rights scoping, one-month response timing, extensions, refusals, processor handoffs, and evidence records.
Direct EU GDPR FAQ answers on scope, controller and processor roles, lawful basis, data subject rights, DPIAs, breach notification, international transfers, and Article 83 fine tiers.
GDPR Chapter V guide to adequacy decisions, SCCs, transfer assessments, supplementary measures, Article 49 derogations, and EU-US DPF checks.
Focused GDPR guide to Article 6 lawful bases, consent conditions, legitimate interests, special category data, withdrawal, and evidence records.
Assess GDPR legitimate interests with a purpose, necessity, balancing, Article 21 objection, and evidence-record workflow based on Article 6(1)(f).
How GDPR main establishment, cross-border processing, Article 56 lead authority competence, and Article 60 cooperation fit together.
This EU GDPR legitimate interests assessment template helps document Article 6(1)(f) purpose, necessity, balancing, safeguards, objection rights, and evidence.
EU GDPR penalties guide covering Article 83 fine ceilings, the EDPB calculation method, CJEU conditions, Article 58 powers, and evidence.
EU GDPR Article 28 guide for processor contracts, sub-processor controls, controller-processor role boundaries, vendor evidence, and SCC transfer clauses where applicable.
Build a GDPR Article 30 record of processing activities with separate controller and processor fields for purposes, data categories, recipients, transfers, erasure time limits, and security measures.
Overview of core EU GDPR requirements covering scope, principles, lawful basis, notices, data-subject rights, processors, RoPA, security, breaches, DPIAs, and international transfers.
Build an EU GDPR retention and erasure schedule with purpose-based periods, expiry actions, Article 17 decisions, recipient notices, and deletion evidence.
A GDPR workflow for checking adequacy, selecting SCC modules, documenting transfer impact assessments, and recording supplementary measures for third-country transfers.
GDPR privacy-notice guide for Articles 12, 13, and 14: direct collection, other data sources, purposes, lawful bases, recipients, transfers, retention, rights, and timing.
Compare EU GDPR and Brazil LGPD scope, actors, legal bases, rights timing, security incidents, international transfers, evidence, regulators, and penalties.
Compare EU GDPR and California CCPA scope, roles, consumer rights, response times, sale and sharing opt-outs, risk assessments, contracts, transfers, and enforcement.
Compare the EU GDPR and ePrivacy Directive for personal data processing, consent and lawful basis, cookies and terminal access, electronic communications, and parallel compliance.
Compare the EU GDPR and amended UK GDPR across scope, rights, automated decisions, accountability, breaches, regulators, and international transfers.
Map the GDPR work that remains necessary when an AI system processes personal data, including lawful basis, notices, DPIAs, Article 22, rights, security, records, and transfers.
Compare GDPR privacy duties with EU Data Act rights and duties for connected-product data, third-party access, data holders, users, contracts, cloud switching, and enforcement.
A GDPR Article 3 territorial-scope FAQ covering EU establishment, non-EU targeting, monitoring in the EU, public-international-law cases, and Article 27 representatives.
FAQ on the six Article 6 GDPR lawful bases, consent caveats, legitimate interests, public-task and legal-obligation limits, and Article 9 special-category data.
FAQ on when EU GDPR controllers may extend, charge for, narrow, redact, or refuse a data subject access request under Articles 12 and 15.
FAQ on when SCC transfer impact assessments are needed, what Clause 14 records, and when supplementary safeguards or transfer suspension are required.
Decide whether a party is a GDPR controller, processor, or joint controller using purpose-and-means tests, Article 28 terms, Article 26 arrangements, and Article 30 records.
Answer the EU GDPR DPIA threshold question with Article 35 triggers, high-risk criteria, supervisory-authority list checks, and DPIA content requirements.
GDPR breach-awareness FAQ covering the Article 33 clock, processor escalation, delayed or phased notifications, risk assessment, and records to keep.