GDPR Article 3 Territorial Scope

It can, but only through the Article 3 triggers. First, GDPR applies to processing carried out in the context of the activities of an establishment of a controller or processor in the Union, even if the processing itself takes place outside the Union.

Second, for a controller or processor not established in the Union, GDPR applies only where the processing relates to offering goods or services to data subjects in the Union or monitoring their behavior as far as that behavior takes place in the Union. The EDPB stresses that the Article 3 assessment is made for the particular processing activity, not by labeling the entire legal entity as globally in scope.

For Article 3(2)(a), the key question is whether the controller or processor appears to envisage offering goods or services to data subjects in one or more EU Member States. Payment is not required.

A website being reachable from the Union, listing an email address, or using a language generally used in the organization's own country is not enough by itself. Stronger evidence can include naming EU Member States in the offer, EU-directed advertising, EU delivery, EU customer references, EU languages or currencies tied to ordering, EU contact details, or an EU top-level domain.

Article 3(2)(b) applies where the processing relates to monitoring data subjects' behavior and that behavior takes place within the Union. The EDPB says monitoring requires attention to the controller's purpose, especially later behavioral analysis or profiling; not every collection or analysis of data from people in the Union is automatically monitoring.

Grounded examples of monitoring indicators include behavioral advertising, geolocation for marketing, online tracking through cookies or fingerprinting, personalized health or diet analytics, CCTV, individual-profile market studies, and monitoring or regular reporting on a person's health status.

Where Article 3(2) applies, a non-EU controller or processor must designate a representative in the Union unless an Article 27(2) exemption applies. The GDPR exemptions are narrow: certain occasional, low-risk processing without large-scale special-category or criminal-offence data, or processing by a public authority or body.

The representative must be established in one of the Member States where the relevant data subjects are located. The EDPB also says designation of a representative does not itself create an EU establishment under Article 3(1), and it does not remove the controller's or processor's own responsibility or liability.