GDPR Applicability and Scope (Article 3)

GDPR Applicability and Scope: Article 3 Extraterritorial Reach

C B Sekhar Director - Cyber Assurance

January 18, 2026

16 min read

In This Guide

Article 3 Explained

Establishment Criterion

Targeting Criterion

Monitoring Criterion

Decision Tree

Practical Examples

Understanding Article 3

Article 3 of GDPR defines its territorial scope. Unlike previous EU data protection law, GDPR has significant extraterritorial reach, applying to organizations worldwide under certain conditions.

GDPR applies through two main criteria:

Establishment criterion (Article 3(1)): Processing in the context of EU establishment

Targeting criterion (Article 3(2)): Processing of EU data subjects' data by non-EU organizations

Establishment Criterion (Article 3(1))

GDPR applies to processing of personal data in the context of the activities of an establishment in the EU, regardless of whether the processing takes place in the EU.

What Constitutes an Establishment?

Any real and effective activity through stable arrangements

Branch offices, subsidiaries, or representatives

A single employee can constitute establishment

Legal form is not determinative

Key Points

Location of processing is irrelevant if establishment exists

Processing must be "in the context of" the establishment's activities

Even if data is processed entirely outside EU, GDPR applies

Targeting Criterion (Article 3(2)(a))

GDPR applies to non-EU organizations processing EU data subjects' data when offering goods or services to them.

Indicators of Targeting EU Data Subjects

Use of EU language (other than English)

Use of EU currency (EUR)

Mention of EU customers or users

EU-specific top-level domain (.de, .fr, .eu)

Delivery to EU addresses

Dedicated EU support or contact details

Monitoring Criterion (Article 3(2)(b))

GDPR applies to non-EU organizations monitoring the behavior of EU data subjects, where that behavior takes place in the EU.

Examples of Monitoring

Tracking individuals on the internet (cookies, device fingerprinting)

Profiling for targeted advertising

Behavioral analytics

Location tracking

Building profiles for credit scoring

Health monitoring via wearables

Quick Decision Tree

Use this decision tree to determine if GDPR applies to your organization:

Step 1: Do you have an establishment in the EU?

Yes: GDPR applies to processing in the context of that establishment

No: Proceed to Step 2

Step 2: Do you offer goods or services to EU data subjects?

Yes (free or paid): GDPR applies

No: Proceed to Step 3

Step 3: Do you monitor behavior of EU data subjects (occurring in EU)?