GDPR Article 3: Territorial scope

What this article means in practice

Written by Engage Compliance. The text above is the article itself, reproduced from its official source and unchanged. Everything in this section is ours, and last read against the current text on 2026-09-07.

Article 3 is the question behind every representative appointment: does the GDPR reach you at all. It catches you in three ways, and the one that matters to a company outside the EU is Article 3(2), which applies the Regulation to processing of people who are in the Union where you offer them goods or services or monitor their behavior. If Article 3(2) catches you, Article 27 usually follows.

Who it binds

• Controllers and processors with an establishment in the Union, for processing in the context of that establishment's activities, wherever the processing physically happens (Article 3(1)).
• Controllers and processors NOT established in the Union, where they process the data of people who are in the Union and the processing relates to offering goods or services to them (Article 3(2)(a)) or to monitoring their behavior in the Union (Article 3(2)(b)).
• Controllers not established in the Union but in a place where Member State law applies by virtue of public international law (Article 3(3)). This is the narrowest limb and catches things like embassies and vessels.
• It turns on where the DATA SUBJECTS are, not on their nationality or residence. Article 3(2) says data subjects who are in the Union, so a US citizen in Berlin is in scope and an EU citizen in Chicago is not.

What it makes somebody do

• You, the controller or processor. Work out which limb, if any, applies to you. Article 3 creates no obligation of its own; it decides whether every other obligation in the Regulation applies.
• You, if Article 3(2) applies. Designate a representative in the Union under Article 27, unless one of the Article 27(2) exemptions holds.
• You, if Article 3(1) applies. Nothing about representatives. An establishment in the Union means Article 27 does not engage, because Article 27(1) is written for controllers and processors not established in the Union.

What it does not say

• It is not about where your servers are. Article 3(1) applies regardless of whether the processing takes place in the Union or not, so hosting data in the EU does not bring you into scope and hosting it elsewhere does not take you out.
• Offering goods or services does not require payment. Article 3(2)(a) says irrespective of whether a payment of the data subject is required, so free products and free tiers count.
• Monitoring behavior is a separate limb, not a subset of offering. A company that sells nothing in the EU but tracks EU visitors is caught by Article 3(2)(b) alone.
• It does not say a website reachable from the EU is enough. Article 3(2)(a) turns on processing RELATED TO the offering, which is a question about what you are doing rather than about who can load your page.
• Article 3(2) does not itself require a representative. It decides that the Regulation applies; Article 27 is the separate provision that requires the appointment, and it has its own exemptions.

How it sits beside the other mandates

• Article 3 and Article 27 are read together in practice and they are different questions. Article 3 asks whether the Regulation reaches you. Article 27 asks, given that it does, whether you have to appoint somebody.
• The UK GDPR has its own Article 3 in the same shape, so a company selling into both the EU and the UK from outside both answers this question twice and can end up with two representatives.
• Where Article 3(2) applies, Article 30 usually applies too, which is what makes the representative appointment operational rather than nominal: the record is the thing the representative holds and an authority asks for.