Where the GDPR applies — Articles 1 to 4 and 27

The GDPR is Regulation (EU) 2016/679. It gives its subject-matter and objectives in Article 1, its material scope in Article 2, and its territorial scope in Article 3. Article 4 gives the definitions that the other Articles use, for example personal data, processing, controller, and processor. Article 27 tells a controller or processor not established in the Union when it must designate a representative in the Union. Use this information to find if the GDPR applies and if you are a controller or processor.

Article 1 — Subject-matter and objectives

GDPR Article 1 gives rules for the protection of natural persons and the free movement of personal data. Article 1(1) is as follows:

This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.

In Article 1(2), the Regulation gives protection to "fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data". In Article 1(3), the free movement of personal data in the Union "shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data".

Article 2 — material scope

Article 2 of the GDPR gives the material scope for processing of personal data by controllers and processors. Article 2(1) is as follows:

This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.

Article 2(2) gives four types of processing of personal data to which the Regulation does not apply:

• Article 2(2)(a) — processing "in the course of an activity which falls outside the scope of Union law".
• Article 2(2)(b) — processing by the Member States "when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU". Recital 16 refers to this processing as processing by the Member States "when carrying out activities in relation to the common foreign and security policy of the Union".
• Article 2(2)(c) — processing "by a natural person in the course of a purely personal or household activity".
• Article 2(2)(d) — processing "by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security".

Article 2(2)(c) applies only to processing by a natural person. Recital 18 gives the interpretation of this point. A purely personal or household activity has "no connection to a professional or commercial activity". Recital 18 adds: "Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities." But the GDPR applies to "controllers or processors which provide the means for processing personal data for such personal or household activities".

Directive (EU) 2016/680 (the Law Enforcement Directive) applies to the processing of Article 2(2)(d) (recital 19). Article 2(2)(d) applies only to processing for the purposes that it gives. It does not apply to all processing by a competent authority. Article 9 of Directive (EU) 2016/680 applies the GDPR to a competent authority's processing in one of these conditions, unless "the processing is carried out in an activity which falls outside the scope of Union law":

• Competent authorities process personal data for other purposes, where "such processing is authorised by Union or Member State law" (Article 9(1)). These are personal data that competent authorities collected for the purposes of Article 2(2)(d).
• Member State law gives a competent authority tasks for other purposes, and the competent authority processes personal data for these tasks (Article 9(2)).

Article 2(3) of the GDPR applies Regulation (EC) No 45/2001 to the processing of personal data by the "Union institutions, bodies, offices and agencies". Regulation (EU) 2018/1725 repealed Regulation (EC) No 45/2001 with effect from 11 December 2018. Article 99 of Regulation (EU) 2018/1725 adds: "References to the repealed Regulation and Decision shall be construed as references to this Regulation." Thus, Article 2(3) refers to Regulation (EU) 2018/1725.

In Article 2(4), the GDPR "shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive".

Article 3 — territorial scope

Article 3 of the GDPR gives the territorial scope for processing by a controller or processor. Article 3 applies only to processing that is also in the material scope of Article 2.

Article 3(1) — establishment in the Union

Article 3(1) of the GDPR is as follows:

This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.

Article 3(1) applies to processing "in the context of the activities of an establishment". Thus an establishment in the Union does not put all processing of an organization in the scope of Article 3(1). The exceptions in Article 2(2) also apply to processing “in the context of the activities of an establishment” in the Union.

Recital 22 gives the interpretation of establishment. Establishment "implies the effective and real exercise of activity through stable arrangements". Recital 22 adds: "The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect."

Article 4(1)(a) of Directive 95/46/EC, which Article 94 of the GDPR repealed, also used the condition "in the context of the activities of an establishment". The Court of Justice gave an interpretation of that condition in its Google Spain judgment of 13 May 2014 (C-131/12). In point 2 of the operative part, the condition applies "when the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State".

Article 3(2) — controllers and processors not established in the Union

Article 3(2) of the GDPR applies to a controller or processor not established in the Union:

This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

Recital 14 applies the protection of the GDPR to natural persons "whatever their nationality or place of residence".

Recital 23 gives the interpretation of the offering of goods or services. The test is "whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union". Recital 23 gives two types of indications:

• These are "insufficient to ascertain such intention": "the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details", or "the use of a language generally used in the third country where the controller is established".
• These "may make it apparent that the controller envisages offering goods or services to data subjects in the Union": "the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language", or "the mentioning of customers or users who are in the Union".

Recital 24 gives the interpretation of monitoring. The test is "whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person". Recital 24 adds "particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes".

For an AI system, do the Article 3(2)(b) test for each processing activity.

Article 3(3) — public international law

Article 3(3) of the GDPR applies the Regulation to the processing of personal data "by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law". Recital 25 gives an example: "such as in a Member State's diplomatic mission or consular post".

Article 27 — Representatives of controllers or processors not established in the Union

In Article 27(1) of the GDPR, where Article 3(2) applies, "the controller or the processor shall designate in writing a representative in the Union". The obligation of Article 27(1) does not apply to:

• Article 27(2)(a) — processing that has all of these three properties, "taking into account the nature, context, scope and purposes of the processing":
  • The processing is "occasional".
  • The processing does not include, "on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10".
  • The processing "is unlikely to result in a risk to the rights and freedoms of natural persons".
• Article 27(2)(b) — a controller or processor that is "a public authority or body".

The representative must be established in one of the Member States where the data subjects are (Article 27(3)). These are the data subjects "whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored". The representative "shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing" (Article 27(4)). The designation of a representative "shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves" (Article 27(5)).

Article 4 — Definitions

Article 4 of the GDPR has 26 definitions, for example data subject, controller, and processor, in points (1) to (26). These definitions include:

• Personal data and data subject (Article 4(1)) — "any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person".
• Processing (Article 4(2)) — "any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction".
• Restriction of processing (Article 4(3)) — "the marking of stored personal data with the aim of limiting their processing in the future".
• Profiling (Article 4(4)) — "any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements".
• Pseudonymization (Article 4(5)) — "the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person".
• Filing system (Article 4(6)) — "any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis".
• Controller (Article 4(7)) — "the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law".
• Processor (Article 4(8)) — "a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller".
• Consent (Article 4(11)) — "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her".
• Personal data breach (Article 4(12)) — "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed".
• Genetic data (Article 4(13)) — "personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question".
• Biometric data (Article 4(14)) — "personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data".
• Data concerning health (Article 4(15)) — "personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status".

Article 4 also gives definitions of recipient (point 9), third party (10), main establishment (16), representative (17), enterprise (18), and group of undertakings (19). Other points give definitions of binding corporate rules (20), supervisory authority (21), supervisory authority concerned (22), and cross-border processing (23). The last three points give definitions of relevant and reasoned objection (24), information society service (25), and international organization (26). The special categories of personal data are in Article 9(1), not in Article 4.

Identifiable natural person

Recital 26 of the GDPR gives the interpretation of identifiable. To find if a natural person is identifiable, "account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly". For this test, "account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments".

In recital 26, the principles of data protection do not apply to "anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable". But personal data after pseudonymization "which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person". Recital 30 gives "internet protocol addresses, cookie identifiers" as examples of online identifiers of natural persons.

The European Data Protection Board (the Board) has its "Guidelines 02/2026 on Anonymisation" in consultation, "Open for feedback" from 8 July to 30 October 2026. These guidelines can change after the consultation.

Profiling

Profiling (Article 4(4) of the GDPR) is a type of processing. Profiling is not a condition for the GDPR to apply: Articles 2 and 3 give the conditions. Some provisions of the GDPR have rules for profiling, for example:

• Articles 13(2)(f), 14(2)(g), and 15(1)(h): the information about "the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4)".
• Article 21(1) and (2): the right to object, which includes "profiling based on those provisions" (points (e) and (f) of Article 6(1)) and profiling "to the extent that it is related to such direct marketing".
• Article 22(1): a decision "based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her".
• Article 35(3)(a): the data protection impact assessment for "a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person" (see Article 35).

An AI system does profiling (Article 4(4)) when its automated processing uses personal data "to evaluate certain personal aspects relating to a natural person". For Article 22, see Article 22 in Principles and rights.

The Digital Omnibus proposal of 19 November 2025 (COM(2025) 837), not law as of October 2026, contains changes to Article 4, and to other Articles.

Controllers and processors

The GDPR sets obligations for the controller and for the processor. A controller "alone or jointly with others, determines the purposes and means of the processing of personal data" (Article 4(7)). A processor "processes personal data on behalf of the controller" (Article 4(8)).

For each processing activity, use Article 4(7) and (8) to find the controller or processor. One organization can be the controller for processing activity A and a processor for processing activity B. It can also be a joint controller with a different organization for processing activity C. Different obligations apply to controllers and processors. For example, Article 24 applies to the controller, and Article 28 applies to the relation between the controller and the processor.

Article 28(10) makes a processor a controller in one condition. If a processor "infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing". This rule applies "Without prejudice to Articles 82, 83 and 84".

Two or more controllers that "jointly determine the purposes and means of processing" are joint controllers (Article 26(1)). For their arrangement and the rights of the data subject against each controller, see the Article 26 section on joint controllers.

The EU AI Act gives definitions of a "provider" (its Article 3(3)) and a "deployer" (its Article 3(4)). These definitions use the relation to an AI system, and they are not the GDPR definitions of controller and processor. The GDPR definitions in Article 4(7) and (8) apply to each processing activity of the same organization.

Scope, controllers, and processors in Modulos

The GDPR Frameworks OFF-11 and MFF-12 have no Requirement for scope decisions or for the identification of controllers and processors (Articles 1 to 4). For ORF-235 (Articles 26 and 27), the GDPR Role tags, and the decisions before you add the Frameworks, see Operationalizing GDPR in Modulos.

Where to go next

GDPR overview

Dates, structure, guidance, case law, and the EU AI Act

Principles and rights of data subjects

Articles 5 to 23: principles, legal basis, consent, special categories, rights of the data subject, and Article 22

Obligations of controllers and processors

Articles 24 to 49: accountability, processors, records, security, personal data breaches, the data protection impact assessment, the data protection officer, and transfers

Supervisory authorities, remedies, and penalties

Articles 51 to 84: supervisory authorities, remedies of data subjects, liability, and administrative fines

GDPR Frameworks in Modulos

The two Frameworks, scope decisions, controllers and processors, the steps, and the Requirements

The EU AI Act and the GDPR compared

How the GDPR and the EU AI Act apply to the same AI system

Sources

• Regulation (EU) 2016/679 (GDPR), OJ L 119, 4.5.2016, p. 1, with the corrigendum in OJ L 127, 23.5.2018, p. 2 (EUR-Lex): Articles 1 to 4, 6(1), 9(1), and 10. Articles 13(2)(f), 14(2)(g), 15(1)(h), 21(1) and (2), 22(1), and 24. Articles 26(1) and (3), 27, 28, 35(3)(a), and 94. Recitals 14, 16, 18, 19, 22 to 26, and 30.
• Directive (EU) 2016/680 (Law Enforcement Directive) (EUR-Lex): Article 9(1) and (2).
• Regulation (EU) 2018/1725 (EUR-Lex): Article 99.
• Directive 2000/31/EC (EUR-Lex): Articles 12 to 15.
• Court of Justice of the European Union, judgment of 13 May 2014, Google Spain and Google, C-131/12 (EUR-Lex): operative part, point 2.
• EDPB, Guidelines 02/2026 on Anonymisation: in consultation, "Open for feedback" from 8 July to 30 October 2026, and can change after the consultation (EDPB).
• COM(2025) 837, the Commission proposal of 19 November 2025 (Digital Omnibus) (EUR-Lex): Article 3, point 1.
• Regulation (EU) 2024/1689 (EU AI Act), consolidated text of 27 July 2026 (EUR-Lex): Article 3(3) and (4).

Disclaimer

This page gives general information. It is not legal advice.