Applicability TestEU

EU GDPR Applicability Test

Decide whether GDPR applies, which role you have, and what to document.

Focus: Article 2 (material scope), Article 3 (territorial scope), Article 27 (representative), and practical outcomes.

Back to main artifact Review sources

Author

Sorena AI

Published

Feb 21, 2026

Updated

Feb 21, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Feb 21, 2026

Updated Feb 21, 2026

Overview

A GDPR applicability decision must be defensible: it should be tied to facts (where processing happens, who is established, and what data subjects you target) and it should produce a concrete output (what controls and evidence you need). This page provides an execution-ready applicability test and the deliverables that make the decision auditable.

Section 1

Step 1 - Material scope (Article 2): are you processing personal data?

Start with the core question: is there processing of personal data (automated or part of a filing system) in your activity?

Then validate whether any Article 2 exclusions are relevant (these often appear in public sector or law enforcement contexts).

List processing activities (products, HR, marketing, analytics, support, vendor operations).
Identify data categories (identifiers, usage, location, sensitive/special category).
Check for exclusions in Article 2(2) and document your reasoning if you rely on one.

Section 2

Step 2 - Territorial scope (Article 3): establishment vs targeting

Article 3 has three key paths: (1) processing in the context of an EU establishment, (2) targeting EU data subjects (goods/services or monitoring behavior), and (3) Member State law applying by public international law.

Your goal is not to win a debate-it's to map facts to the Article 3 path and keep evidence of that mapping.

Establishment criterion (Article 3(1)): document EU presence and whether processing is in the context of EU activities.
Targeting criterion (Article 3(2)): document intentional offering of goods/services to EU data subjects or monitoring behavior in the EU.
Representative (Article 27): if you're not established in the EU but Article 3(2) applies, assess representative obligations and exceptions.

Section 3

Step 3 - Role mapping: controller vs processor (what changes in practice)

Role mapping is a control design step: it determines who owns transparency, DSAR handling, DPIAs, and vendor oversight.

Most failures happen when teams label themselves a processor but behave like a controller, or the reverse.

Controller: determines purposes and essential means; owns lawful basis, notices, DSAR outcomes, and DPIA decisions.
Processor: processes on behalf of a controller; must follow Article 28 contract requirements and implement appropriate security.
Joint controllers: if purposes/means are decided together, you likely need a joint-controller arrangement and allocation of responsibilities.

Section 4

Borderline scenarios (fast checks that prevent scope mistakes)

Use these as red flag prompts in scoping workshops. If any apply, you likely need deeper analysis and stronger documentation.

US company with EU customers and localized EU marketing pages (targeting signals).
Analytics/behavioral monitoring of EU visitors for profiling or advertising (monitoring).
EU-based employees or contractors with HR systems hosted outside the EU (establishment context + transfers).
B2B SaaS with EU accounts where usage data and support tickets include personal data.
Vendor ecosystem where sub-processors are in third countries (transfer chain risk).

Section 5

Outputs: what you should produce after the applicability test

A good applicability test ends with artifacts, not a sentence. These outputs are what make the decision explainable and actionable.

Applicability memo: the Article 3 path (with facts and evidence) and the role mapping per processing activity.
Processing inventory scope baseline: which systems and teams are in scope now.
Control backlog: DSAR workflow, breach playbook, DPIA triggers, transfer safeguards, vendor contract updates.
Evidence index: where your key compliance evidence lives and how fast it can be exported.

Recommended next step

Turn EU GDPR Applicability Test into an operational assessment

Assessment Autopilot can take EU GDPR Applicability Test from deciding whether these obligations apply in practice to a reusable workflow inside Sorena. Teams working on EU GDPR can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Assessment workflow

Open Assessment Autopilot for EU GDPR Applicability Test

Start from EU GDPR Applicability Test and turn the guidance into owned tasks, evidence requests, and review checkpoints.

Explore next step

Talk to Sorena

Talk through EU GDPR

Review your current process, evidence gaps, and next steps for EU GDPR Applicability Test.

Explore next step

Primary sources