<iframe src="//www.googletagmanager.com/ns.html?id=GTM-5T7PGR" height="0" width="0" style="display:none;visibility:hidden">


About Froriep Blog

No matter what part you play in the economy, our blog will provide you with a wealth of up-to-date and interesting articles, resources and checklists from the various areas of law.

The blog’s authors are all partners and employees of our firm, ensuring you benefit not only from the best legal knowledge, but also from examples drawn from their many years of practical experience.

Subscribe to the Blog

26 November 2018

Shedding some light on the territorial scope of the GDPR

The European Data Protection Board (EDPB) following its fourth plenary session on November 16th of this year has published guidelines on the territorial scope of the General Data Protection Regulation (GDPR) for public consultation. The public consultation will be organised from 23 November 2018 to 18 January 2019.


Before the publication of these guidelines, much has been speculated and argued in and outside of the European Union (EU) regarding the effect of the GDPR and whether or not third countries would have to follow the rules set out in the Regulation. Nevertheless, many companies established in third countries dealing with the EU were unsure how to proceed. Although especially questions regarding enforcement actions and obligations in third countries remained unanswered, the bottom line drawn by most privacy professionals was that third-country controllers and processors with strong links to the EU should comply with the GDPR.

The newly published and long-awaited guidelines will now shed some light on the many questions asked by privacy professionals with regard to issues arising out of the GDPR. With the release of the guidelines, the EDPB in particular intends to clarify the territorial scope of the GDPR to ensure a common interpretation. While national enforcement in countries outside the EU remains a matter for those national laws, among other issues addressed, the guidelines do provide clarification on issues around:

  • the application of the establishment criterion in the context of controllers and processors established outside the EU;
  • the application of the targeting criterion in the context of controllers and processors established outside the EU;
  • the processing in a place where Member State law applies by virtue of public international law; and
  • the requirement for third country controllers or processors to designate an EU representative.

Click on the button below for the full text of the guidelines.



If you liked this article, you might be interested in reading about:

Checklist for a controller and processor agreement under the GDPR, by Nicola Benz and Ronald Kogens

Checklist Privacy Policy under the GDPR, by Nicola Benz and Cornelia Mattig

Simple in theory, complex in practice: the dual role as controller and processor under the General Data Protection Regulation, by Nicola Benz and Ronald Kogens 

Check for GDPR Compliance and receive a customised list of next steps for free, by Ronald Kogens and Nicola Benz


Photo by Mikael Kristenson on Unsplash

Topics: Data Privacy 

Share or Print this blog post:


Leave a comment here