Executive Summary
Regulation on data protection and privacy in the European Union
("EU" or
"Union") is governed by the General Data
Protection Regulation ("GDPR" or
"Regulation"). On November 12, 2019, the
European Data Protection Board ("EDPB")
adopted a final version of Guidelines 3/2018 on the territorial
scope of the GDPR.
Under the GDPR, jurisdiction is less related to the location
where a business is incorporated or headquartered and more to the
scope and location of business activity. It will also apply to
businesses outside the EU if their data processing activities
relate to the offering of goods or services to individuals in the
EU or to the monitoring of such individuals' behaviour. This
latter provision expands the territorial scope of the GDPR well
beyond the EU, essentially making it global law. As such, it is
important to understand the territorial scope of the GDPR.
