Territorial Scope Of GDPR For Non-EU Companies

General Data Protection Regulation ("GDPR") has entered into force May 25, 2018. Article 3 of the GDPR determines territorial principle of the GDPR and it could be the most controversial provision of the GDPR. In this context, the European Data Protection Board published the Guidelines 3/2018 on the territorial scope of the GDPR on November 16, 2018 ("Guideline"). Article 3(1) of GDPR states that "Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not." This provision considers "establishment" criterion of application. Article 3(2) of GDPR provides the situation in which the GDPR applies to a data controller or data processor not established in the Union. This provision is based on the "targeting" criterion.¹