EDPB Issues Much-Awaited Guidance On GDPR's Territorial Scope

On 16 November 2018, the European Data Protection Board (EDPB) adopted draft guidelines on the territorial scope of the General Data Protection Regulation (GDPR) (the guidelines).

This is the first of two blogs on the guidelines. This blog considers the extra-territorial scope of the GDPR. Next week, we will consider the need for non-European Union (EU) controllers to designate a representative located in the EU.

Territorial scope

The GDPR has extra-territorial effect. This means it can apply to companies based outside of the EU.

GDPR applies to a non-EU-based company where that company:

1. Processes personal data in the context of the activities of an EU establishment (the establishment criterion);