The territorial scope of the General Data Protection Regulations
(the 'GDPR' or the 'regulation') is determined
within Article 3, adopting two main criteria for this purpose;
'establishment' and 'targeting'. Where one of these
two criteria is met, all relevant provisions of the GDPR will apply
to the relevant processing of personal data performed by the
controller or processor concerned.
Controllers or processors established in the EU
It probably comes as no surprise that the GDPR applies to
organisations which are established within the EU, if personal data
is processed 'in the context of the activities' of such an
establishment. The fact that this applies regardless of whether the
actual processing of the data takes place in the EU or not might,
however, be less obvious. According to recital 22, an establishment
implies the effective and real exercise of activities – even
a minimal one – through stable arrangements. The legal form
of such arrangements, whether
