# GDPR Article 3: Territorial Scope

- Source: https://support.icompaas.com/support/solutions/articles/62000236283-gdpr-article-3-territorial-scope
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GDPR](https://support.icompaas.com/support/solutions/62000112722) › [Chapter I: General Provisions](https://support.icompaas.com/support/solutions/folders/gdpr-chapter-1-general-provisions)
- Last updated: 2026-07-11
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Overview**

This article defines the territorial reach of GDPR, applying to personal data processing conducted by entities established in the EU, as well as non-EU organizations that target or offer goods/services to EU data subjects or monitor their behavior. GDPR also applies when processing falls under applicable Member State law.

  

### **Key Principles**

-   EU Establishment: Any controller or processor established in the EU is subject to GDPR.
    
-   Targeting EU Data Subjects: Non-EU organizations offering goods/services to or monitoring EU individuals fall under GDPR.
    
-   Member State Law Applicability: GDPR applies where local EU laws govern the processing.  
      
    

### **Organizational Applicability**

Applies to:

-   EU-based controllers and processors handling personal data.
    
-   Non-EU organizations targeting or offering services to EU residents.
    
-   Non-EU organizations monitoring behavior of EU data subjects.  
    Organizations must assess whether their activities trigger GDPR obligations in any EU jurisdiction.
    

  

### **Implementation Requirements**

-   Identify whether the organization or processing activity falls under EU establishment or targets EU data subjects.
    
-   Maintain records demonstrating whether GDPR applies, including contracts, website targeting evidence, and service offerings.
    
-   Implement GDPR-aligned data protection measures for all processing that falls within the scope.  
      
    

### **Implementation Guidance**

-   Map all processing activities to determine territorial applicability.
    
-   Review websites, marketing campaigns, and services to confirm targeting or monitoring of EU individuals.
    
-   Ensure GDPR-compliant policies, notices, and contracts are applied for all in-scope processing.
    
-   Document decisions and assessments to demonstrate compliance during audits.  
      
    

### **Periodic Review**

-   Frequency: Annually or upon expansion into new markets or changes in service offerings.
    
-   Responsible Role: Data Protection Officer (DPO) or Compliance Team.
    
-   Outcome: Confirm ongoing applicability of GDPR and update documentation and measures accordingly.  
      
    

### **Non-Compliance Risks**

-   Fines: Up to €20 million or 4% of global annual turnover.
    
-   Legal Exposure: Enforcement actions from EU regulators.
    
-   Reputational Damage: Loss of trust from EU customers and partners.
    
-   Operational Limitations: Restrictions on offering services in EU markets.

## Related compliance guidance

- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): How the Regulation fits together as a programme — lawful bases, Article 28/30/32/33 obligations, transfers and the DPIA process.
- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): If you also serve users in India, the DPDP Act borrows GDPR concepts but differs on consent, breach reporting and transfers.