Guidelines On The Territorial Scope Of The GDPR

The EDPB published its finalised Guidelines 3/2018 on the territorial scope of the GDPR on 12 November 2019 (the "Guidelines"). The purpose of the Guidelines is to help controllers, processors and supervisory authorities in determining whether a particular processing activity falls within the territorial scope of the GDPR. Indeed, for the main criteria of Article 3 of the GDPR (the "establishment" and the "targeting" criteria), the EDPB developed an approach for determining whether or not the GDPR applies to a specific data processing activity. The Guidelines also provide some useful information regarding the (non-)designation of a representative for controllers or processors not established in the EU as well as its related obligations and responsibilities.

The following observations can be made regarding the updated Guidelines:

the application of Article 3 aims at determining whether a particular processing activity (on a processing-by-processing basis), rather than a (legal or natural) person falls within the scope of the GDPR. Therefore, for the same controller/processor, certain processing of personal data might fall within the scope of the GDPR, while other processing might not (we underline); where a non-EU controller or processor 'inadvertently or incidentally' targets its goods or services at a data subject located in the EU, such processing of personal data will not fall...