# GDPR Article 3: Territorial scope

General Data Protection Regulation (GDPR), version 2026.1, in force since 25 May 2018. Read from https://publications.europa.eu/resource/celex/02016R0679-20160504. Each clause starts with its key, which is how to cite it.

## gdpr:art-3:para-1

1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.

## gdpr:art-3:para-2

2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

### gdpr:art-3:para-2:pt-a

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

### gdpr:art-3:para-2:pt-b

(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

## gdpr:art-3:para-3

3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.

Page: https://dpolens.com/laws/gdpr/art-3