GDPR can apply even if your company is outside the EU. Article 3 covers non-EU organizations that process personal data of people in the EU when they offer them goods or services, or monitor their behavior in the EU. Where the company is based does not decide it, what you do does.
What does Article 3 say?
Article 3 sets out the territorial scope in three parts.
First, the regulation applies to processing of personal data in the context of the activities of an establishment of a controller or processor in the Union, whether or not the processing takes place in the Union.
Second, it applies to processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing relates to either of two things. One is offering goods or services to those people, whether or not payment is required. The other is monitoring their behavior, as far as that behavior takes place in the Union.
Third, it applies to a controller not established in the Union but in a place where Member State law applies by virtue of public international law.
Why does the second part catch so many companies?
Notice the words in the Union. The test looks at where the person is, not their citizenship or where your servers are. A free app counts, because the text says payment is not required. A website with no sales team in Europe can still be covered if it is aimed at people there.
The recitals attached to Article 3 add detail on how to judge whether you are targeting people in the Union, and on what counts as monitoring through profiling. Read them alongside the article, since they show the kind of evidence a regulator looks at.
What does not count automatically?
Being reachable from the EU is not the same as targeting it. A site that happens to load in Europe, with no language, currency, marketing or product aimed there, is a different case from one that sells in euros with local language pages. This is a question for your lawyer, because the answer turns on facts about your business.
A constructed example
A software company in Texas offers a free note taking app. It has a Spanish and a German interface, accepts euros for its paid tier, and runs analytics that track what users do in the app. Even though it has no office in Europe, the offering of services to people in the Union and the monitoring of their behavior point to Article 3 applying. A second company runs a local plumbing business website in Ohio with English text only and no EU targeting. The test is unlikely to be met.
How to check or apply this
- Write down where your users are, by country, using real data.
- List signals that you target the EU: languages, currencies, local pricing, local marketing, shipping to EU addresses.
- List any tracking or profiling of people's behavior, such as analytics or ad pixels, and where those people are.
- Read Article 3 and its recitals with those lists beside you.
- Ask qualified legal counsel for a written view if the answer is not clear.
- If it applies, map your personal data flows, then look at your obligations as controller or processor.
- Revisit the question when you launch in a new market or add tracking.
Safeguard helps with the technical record keeping side of compliance work, such as compliance automation and an inventory of the software that touches data. It does not give legal advice or certify GDPR compliance.
Quick check
Does GDPR apply to free services?
It can. Article 3 says the offering of goods or services counts whether or not payment is required.
Does it apply because an EU citizen visits my site?
Not on its own. The test is about people in the Union and whether you offer them goods or services or monitor their behavior there.
Sources
Last reviewed: 18 October 2026.
