Territorial and Material Scope

Question 1

What is the territorial scope of GDPR?

Answer 1

Where the Regulation applies:

1. EU-established organisations
2. On a lon-arm, extraterritorial basis to organisations which offer to sell goods or services to or who monitor individuals in the EU.

Question 2

When is a organisation established in EU?

Answer 2

The Regulation doesn’t define ‘established’, but the term has a broad meaning. Weltimmo v. NAIH: broad concept of establishment.

Question 3

Does the appointment of a EU Representative mean hat the controller or processor is established in the EU?

Answer 3

No, the EDPB guidelines confirm that it doesn’t.

Question 4

What is the two questions of art. 3(1)?

Answer 4

1. Whether or not an organisation has an establishment in the EU.
2. Whether or not the processing of personal data at issue is carried out ‘in the context of the activities of the establishment’.