Written by the GDPR Exam Trainer Editorial Team for DPO exam candidates. Checked against Regulation (EU) 2016/679 and EDPB Guidelines 3/2018 version 2.1; no natural person is named as author. Builds on the EU GDPR explained. A typical candidate question is whether a company with no EU office is outside the GDPR. That is a study question, not a legal source.
Does the GDPR apply outside the EU without an office there?
Yes, it can: Article 3(2) applies to processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the activities relate to offering goods or services to those data subjects, irrespective of payment, or to monitoring of their behaviour as far as that behaviour takes place within the Union.
Article 3(1) is a different limb: Union establishment, regardless of whether the processing takes place in the Union. Article 3(3) covers a controller not established in the Union but in a place where Member State law applies by virtue of public international law. Article 3(2), not paragraph 1 or 3, refers to data subjects who are in the Union; it does not use citizenship as the connecting factor.
What is the Article 3(1) establishment test?
Article 3(1) applies the Regulation to processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.
Recital 22: establishment implies the effective and real exercise of activity through stable arrangements; the legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor. EDPB Guidelines 3/2018 add that processing by a controller or processor established outside the EU may be inextricably linked to the activities of a local establishment in a Member State and thereby may trigger the applicability of EU law, even if that local establishment is not actually taking any role in the data processing itself, if a case by case analysis on the facts shows that there is an inextricable link. That sentence is EDPB guidance, not the Regulation.
When is a website offering goods or monitoring behaviour?
Article 3(2)(a) is offering goods or services, irrespective of whether a payment of the data subject is required, to data subjects in the Union; Article 3(2)(b) is monitoring of their behaviour as far as their behaviour takes place within the Union.
Recital 23: mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain intention. Factors that may make it apparent include a language or currency generally used in one or more Member States with the possibility of ordering in that other language, or mentioning customers or users who are in the Union. Recital 24, in order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, says it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes. Recital 25 gives as an example a Member State's diplomatic mission or consular post under Article 3(3).
Does using an EU processor pull a non-EU controller into the GDPR?
EDPB Guidelines 3/2018, on a non-EU controller that is not otherwise subject to the GDPR, state that such a controller will not become subject to the GDPR simply because it chooses to use a processor in the Union; that processor can still be subject to processor obligations under Article 3(1).
EDPB Example 7: a Mexican retail company contracts a Spanish processor for its clients' data, offers and directs its services exclusively to the Mexican market, and its processing concerns exclusively data subjects located outside the Union. The EDPB treats that controller as not subject to the GDPR as per Article 3(2) and not under Article 3(1), while the Spanish processor's processing falls within the scope of the GDPR by virtue of Article 3(1) for processor obligations. That example is EDPB guidance, not the Regulation. Related reading: Article 28 processor agreements and international data transfers.
When is an Article 27 representative required?
Where Article 3(2) applies, Article 27(1) requires the controller or the processor to designate in writing a representative in the Union, unless Article 27(2) applies.
Article 27(2)(a) covers processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing. Article 27(2)(b) is a public authority or body. Article 27(3) requires establishment in one of the Member States where the relevant data subjects are. Article 4, point (17), defines representative as a natural or legal person established in the Union who, designated by the controller or processor in writing pursuant to Article 27, represents the controller or processor with regard to their respective obligations under this Regulation. The EDPB does not consider the function of representative in the Union as compatible with the role of an external data protection officer which would be established in the Union. See Article 37 and Article 9.
How do the Article 3 limbs compare?
Article 3 has three limbs: Union establishment (paragraph 1), targeting of data subjects who are in the Union by a non-established controller or processor (paragraph 2), and public-international-law application of Member State law (paragraph 3). Article 27(1) is triggered where Article 3(2) applies, not by paragraph 1 or paragraph 3 as such.
| Limb | Who | Trigger | Article 27 |
|---|---|---|---|
| Art. 3 Abs. 1 GDPR | Controller or processor with a Union establishment | Processing in the context of the activities of that establishment, regardless of where the processing takes place | Article 27(1) names Article 3(2), not paragraph 1 |
| Art. 3 Abs. 2 GDPR (a) | Controller or processor not established in the Union | Processing of personal data of data subjects who are in the Union, related to offering goods or services to them, irrespective of payment | Yes, unless Article 27(2) |
| Art. 3 Abs. 2 GDPR (b) | Controller or processor not established in the Union | Processing of personal data of data subjects who are in the Union, related to monitoring of their behaviour as far as it takes place within the Union | Yes, unless Article 27(2) |
| Art. 3 Abs. 3 GDPR | Controller not established in the Union | A place where Member State law applies by virtue of public international law | Article 27(1) names Article 3(2), not paragraph 3 |
Which Article 83 fine tier lists Article 27?
Article 83(4)(a) lists the obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39 and 42 and 43 in the tier of administrative fines up to 10 000 000 EUR, or for an undertaking up to 2 % of total worldwide annual turnover of the preceding financial year, whichever is higher. Article 27 sits inside Articles 25 to 39.
Fine method: how GDPR fines are calculated.
Frequently asked questions
Does the GDPR apply to a company with no EU office?
Yes, it can, through Article 3(2): a controller or processor not established in the Union is in scope where the processing of personal data of data subjects who are in the Union is related to offering goods or services, irrespective of payment, or to monitoring of their behaviour as far as that behaviour takes place within the Union. Article 3(1) is a different limb and requires a Union establishment. Recital 22 says the legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor.
Does a website that people in the EU can open fall under Article 3(2)(a)?
Not by mere accessibility. Recital 23 states that mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention.
Does hiring an EU processor put a non-EU controller under the GDPR?
Not by that choice alone, where the non-EU controller is not otherwise subject to the GDPR. EDPB Guidelines 3/2018 state that such a controller will not become subject to the GDPR simply because it chooses to use a processor in the Union. The Union processor can still be subject to processor obligations under Article 3(1).
When is an Article 27 representative not required?
Article 27(1) applies where Article 3(2) applies. Article 27(2) then disapplies that duty: (a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or (b) a public authority or body.