Fiche 4/54 Part I — General Introduction Intermediate Reviewed 2026-08-23

Scope of Application: Material & Territorial (Art. 2 & 3)

Articles 2 and 3 establish when and where the GDPR applies. It covers automated or structured processing globally whenever an EU establishment is involved or individuals in the EU are targeted.

Open in interactive reader

⚖️ Binding Text 📋 EDPB Guidelines 3/2018

Material & Territorial Scope (Art. 2 & 3)

⚡ In 30 seconds

The GDPR applies to the automated processing of personal data and to non-automated processing forming part of a filing system (Art. 2). Territorially, it binds controllers established in the EU (Art. 3.1) and controllers outside the EU if they offer goods or services to individuals in the Union or monitor their behaviour within the EU (Art. 3.2).

📦 Material Scope (Art. 2)

Included: Digital databases, automated pipelines, indexed paper archives.
Excluded: National security, purely personal or household activities (Lindqvist, C-101/01).

🌍 Territorial Scope (Art. 3)

Art. 3(1) Establishment: Any processing in the context of the activities of an EU establishment.
Art. 3(2) Targeting: Foreign entities offering goods/services or tracking EU web/app users.

⚡ Key Takeaways

Extraterritorial reach captures international cloud providers and analytics platforms.
The household exemption ceases to apply once data is made accessible to an indefinite audience.
Physical presence of the data subject in the EU triggers protection, regardless of nationality.

⚠️ Common Pitfall

Confusing nationality with geographic location; EU citizens living abroad are not automatically covered by Art. 3.2.

🛠️ In Practice

Audit whether foreign web traffic tracking or currencies target European end users to assess extraterritorial compliance obligations.

⚖️ Official Sources: Art. 2 & 3 GDPR · EDPB Guidelines 3/2018 · CJEU C-101/01 Lindqvist ✓ Legal review: 23 August 2026