EDPB Guidelines 3/2018, summarised

What the guidelines cover

Guidelines 3/2018 are the European Data Protection Board’s authoritative interpretation of the GDPR’s territorial scope — Article 3. They explain when the GDPR applies to an organisation, and they are the reason so many non-EU companies fall within it. The two routes into scope are the establishment criterion and the targeting criterion.

The establishment criterion (Article 3(1))

The GDPR applies to processing carried out “in the context of the activities of an establishment” in the EU — regardless of where the processing itself happens. The EDPB reads “establishment” broadly: even a single representative or a stable arrangement can count, but a mere website accessible from the EU does not. If this applies to you, you are in scope under 3(1) and do not separately appoint an Article 27 representative for that processing.

The targeting criterion (Article 3(2))

For organisations without an EU establishment, the GDPR still applies where they target people in the EU in one of two ways:

• Offering goods or services to people in the EU (whether or not payment is required), and
• Monitoring the behaviour of people that takes place within the EU.

This targeting criterion is what brings most non-EU SaaS, e-commerce and app businesses into scope — and triggers the Article 27 representative requirement.

What shows you are “targeting” the EU

The EDPB lists factors that, taken together, indicate an intention to offer services to people in the EU — no single one is decisive:

• Using an EU language or currency not used in your home country
• Mentioning EU users, customers or countries
• Offering delivery to EU member states
• EU-targeted marketing or an EU country-code domain

Mere accessibility of a website from the EU, or the incidental presence of an EU language (e.g. English on a US site), is not enough on its own.

What it means for you

If the targeting criterion applies, you are within the GDPR and — unless a narrow exception fits — you must appoint an EU representative under Article 27. See our requirements guide or check your situation with the compliance checker. The full guidelines are published by the European Data Protection Board.