All 99 Articles Chapter 1: General Provisions
The GDPR's reach is extra-territorial. It applies to organisations established in the EU, and to those outside the EU that offer goods or services to, or monitor, people in the EU.
Key points
- Covers processing by an EU establishment, wherever the processing happens.
- Covers non-EU organisations targeting or monitoring people in the EU.
- Non-EU controllers may need to appoint an EU representative (Article 27).
Related articles
Learn the context
These summaries are a plain-English orientation only and are not a substitute for the official text of the Regulation or for legal advice.
Need to apply Article 3?
Our data-protection lawyers turn the text into a plan.