GDPR for International Customers: Territorial Scope (Art. 3)

Main article: Third Country — glossary — the term and scope of 'third country' under Chapter V GDPR.

1. Art. 3 GDPR marketplace principle

The GDPR applies as soon as one of the connecting factors in Art. 3 is met — where the company is established does not decide the question. The table below sets out which three connecting factors these are, together with the references. What matters under Art. 3(2) GDPR is that the data subjects are in the Union — not their nationality. Non-EU citizens who are in the EU are therefore covered; EU citizens outside the EU, by contrast, are not covered merely because of their nationality.

Which follow-on obligations hang on applicability — representative, record, deadlines — is set out in section 8.

2. US recipients: what the GDPR requires — and what applies alongside it

For US recipients the GDPR requires the same as for any other third country: a documented basis for the transfer — an adequacy decision or standard contractual clauses (section 6). Alongside this, state-level data protection laws apply in the USA: as at the first version (2 May 2026), besides California, states including Virginia, Colorado, Connecticut and Utah had their own data protection laws; in the editors' assessment, the Californian law (CCPA/CPRA) is the strictest. This has no bearing on whether the GDPR applies — that is governed solely by Art. 3 GDPR. Whether a state law also applies to you is determined by that law's own scope — assess it separately for each state in the law itself. The substantive comparison of the CCPA and the GDPR is set out in the glossary article CCPA vs. GDPR.

On the GDPR side, the only US-specific point is the basis for the safeguard: for the USA, as at the documented status of 2 May 2026, the EU-US Data Privacy Framework provides an adequacy decision, but it only covers recipients certified by name; if the recipient is not certified, the standard contractual clauses 2021/914 together with a transfer impact assessment provide the basis. The related evidence — record entry, third-country notice, data processing agreement — is the same for every third country and is set out in section 6, with the order of work in section 7. A missing third-country notice for US tools is among the common errors in the record of processing activities: so start by checking your US tools — newsletter distribution, web analytics, CRM, video conferencing — to see whether they are marked in the record as third-country recipients and whether the privacy notice contains the information required under Art. 13(1)(f) GDPR.

3. UK recipients: assess and date the basis for the transfer

For UK recipients you need a documented basis for the transfer; Brexit changes nothing about the applicability assessment under Art. 3. As at 17 August 2026: post-Brexit the UK GDPR is a GDPR clone, the Data Protection Act 2018 supplements it, and for the United Kingdom the adequacy decisions (EU) 2021/1772 (GDPR) and (EU) 2021/1773 (Directive (EU) 2016/680) apply as amended by amending decisions (EU) 2025/2574 and (EU) 2025/2571 of 19 December 2025; both now expire on 27 December 2031 unless they are extended. Check that they still apply before every transfer, following the practical recommendation below.

Practical recommendation: call up the EU-UK adequacy decision on EUR-Lex or via the European Commission's data protection page (sources block), check in the text of the decision whether and until when it applies, and record the result together with the safeguard in the record of processing activities (Art. 30(1) GDPR) — the date of the check and the version checked are practice fields here. If the decision does not provide a basis, rely on the standard contractual clauses 2021/914 in line with section 6. Until your assessment result is documented, do not make any new transfers to the UK without one of the safeguards from section 6.

4. Other third countries (including Asia): determining the basis for the transfer

For recipients in Asia and in all other third countries, a single question decides the safeguard: is there a Commission adequacy decision for the recipient country? The table below takes the most common findings through to the document you then file; the last row additionally covers the case of processing on your behalf.

As at 2 May 2026, the national data protection laws in Asia — Singapore PDPA, Japan APPI, China PIPL — are similar to the GDPR but differ in their design. That does not change your basis for the transfer: what matters remains which of the first three rows applies to your recipient; the fourth row is added where the recipient processes data on your behalf. What local law additionally requires of the recipient is a matter for case-by-case advice in the relevant jurisdiction. The related evidence is set out in section 6.

5. Multi-jurisdiction strategy

Treat the GDPR as the strictest benchmark and depart from it only where another jurisdiction requires it: local adjustments for the CCPA and the UK GDPR, one global privacy notice with a separate section per jurisdiction. In concrete terms: for customers in third countries, assess the relevant national or state data protection law separately — for California, the comparison is set out in the glossary article CCPA vs. GDPR, for UK recipients the assessment in section 3. Within the EU this cannot be fully harmonised: for access to terminal equipment, Germany and Austria each have their own national legal basis — comparable in substance, different in the reference (§ 25(1) TDDDG and § 165 TKG 2021 respectively). The privacy notice, by contrast, follows directly from Art. 13 and Art. 14 GDPR in both countries; what differs nationally is the complaints body to be named (Art. 13(2)(d) GDPR) and the recipient categories typical for each country — in Austria, for instance, the ÖGK instead of the statutory health insurance fund in Germany. It is these two items, plus the legal basis for terminal-equipment access, that a separate section per jurisdiction should set out.

Consent for access to terminal equipment. In Germany, storing information in terminal equipment and accessing information already stored there are permitted only where the end user has consented on the basis of clear and comprehensive information; the information and the consent are governed by the GDPR (§ 25(1) TDDDG). No consent is required where the sole purpose is to carry out the transmission of a message, or where the access is strictly necessary in order to provide a digital service expressly requested by the user (§ 25(2) TDDDG). In Austria, tracking cookies require opt-in consent under § 165 TKG 2021.

Complaints body in the privacy notice (Art. 13(2)(d) GDPR): in Germany, the authorities competent under Land law supervise non-public bodies (§ 40(1) BDSG); for the federal public bodies, the Federal Commissioner for Data Protection (BfDI) is competent (§ 9(1) BDSG). In Austria it is the Austrian Data Protection Authority (Datenschutzbehörde) (§ 18(1) DSG).

Practical recommendations, not statutory requirements: serve the banner variant according to the visitor's location (geo-IP) and document the applicable reference for each jurisdiction — § 25(1) TDDDG in Germany, § 165 TKG 2021 in Austria. Translate the privacy notice into your customers' languages, typically English as well as the German-language versions for Germany and Austria where you sell internationally; the mandatory content itself — third-country notice and complaints body — is unaffected by the choice of language.

6. Securing third-country transfers: adequacy decision, SCCs, TIA

As a rule, transfers to third-country recipients require a documented safeguard — in practice an adequacy decision or standard contractual clauses (SCCs). For the USA, the relevant adequacy decision is the EU-US Data Privacy Framework (DPF), Implementing Decision (EU) 2023/1795, in force since 10 July 2023; it replaces the Privacy Shield struck down in 2020 and is effective only for recipients that are themselves certified and recertify annually. So check certification for each recipient by name in the list on dataprivacyframework.gov, not on the basis of the provider's marketing. What has to be documented by law is the safeguard itself (Art. 30(1) GDPR). Practical recommendation: also record the certification status, the date of the last recertification and the date of your own check in the same column, and repeat the check before every new transfer.

Up to three items of evidence arise for each third-country recipient, regardless of which safeguard applies: the entry with the safeguard in the record of processing activities (Art. 30(1) GDPR), the third-country notice in the privacy notice (Art. 13(1)(f) GDPR) and — where the recipient processes data on your behalf — the data processing agreement (Art. 28(1) and (3) GDPR). Processors record their own third-country transfers, including the documentation of appropriate safeguards, in their own record (Art. 30(2)(c) GDPR).

The overview below reflects the status documented by our sister article 'Schrems II + DPF Update 2026' as at 2 May 2026. It is not an update to the editorial status of this article.

If the US recipient is not DPF-certified, the standard contractual clauses 2021/914 together with a transfer impact assessment (TIA) provide the basis. Its minimum content, as our practical recommendation: categories of data and categories of recipients; possible access by US authorities (FISA 702, EO 12333, CLOUD Act); an assessment of whether particularly sensitive data are affected; encryption at rest and in transit; key control held by the controller or by the provider; additional technical and contractual measures; residual risk assessment. Where the transfer relies on the adequacy decision — under the DPF, that is, to a certified recipient — EDPB recommendations 01/2020 require no further assessment steps, but they do require continuous monitoring of whether the decision has been revoked or invalidated (para. 19); keeping a TIA as a fallback under the DPF as well is our practical recommendation, not an obligation under the decision. For special categories under Art. 9 GDPR we recommend not locating the processing in the USA. Where that cannot be avoided, also document in the TIA the EU region enforced at the provider, encryption at rest and in transit with key control held by the controller, and a separate residual risk assessment for the category of data concerned (practical recommendation).

7. Order of assessment for international customer relationships

Work through the assessment from the inventory to consent — that way third-country transfers are captured systematically instead of surfacing only in a supervisory authority enquiry. The order is a practical recommendation; the references in the right-hand column are the applicable legal bases in each case, not deadlines set by us.

On step 1: the exception in Art. 30(5) GDPR applies only cumulatively — fewer than 250 employees AND no risk to the rights and freedoms of data subjects AND no regular processing AND no special categories under Art. 9 or criminal-law data. The official wording refers to 'a risk', not to a high risk. On step 4: if you have designated a representative, our practical recommendation is that their contact details also belong in the privacy notice (section 8).

8. Representative under Art. 27 — and the obligations that come with it

Under Art. 27(1) GDPR, a representative must be designated in the Union where there is no establishment in the EU and Art. 3(2) applies. Exceptions under Art. 27(2): occasional processing only, without large-scale Art. 9/10 data and without a likely risk, as well as public authorities and public bodies. A representative in a third country — in the USA, for example — does not satisfy this obligation; the provision requires a representative in the Union. In practice, the designation is frequently made through a law firm. Practical recommendation: appoint the representative in writing and state their contact details in the privacy notice.

With applicability come the remaining GDPR obligations. The record of processing activities is expressly maintained by 'each controller and, where applicable, the controller's representative' (Art. 30(1) GDPR). Requests from data subjects must be answered without undue delay and at the latest within one month, extendable by two months (Art. 12(3) GDPR). Personal data breaches must be notified without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons (Art. 33(1) GDPR). In Austria, the obligation to designate a data protection officer follows directly from Art. 37(1) GDPR with no additional headcount threshold; in Germany, the threshold of, as a rule, at least 20 persons constantly engaged in automated processing is added (§ 38(1) sentence 1 BDSG). Irrespective of the number of persons, the obligation also arises in Germany for processing operations subject to a data protection impact assessment under Art. 35 GDPR, as well as for commercial transfer, transfer of anonymised data, or market and opinion research (§ 38(1) sentence 2 BDSG).

Infringements of the obligations in Art. 25–39 GDPR — including the representative under Art. 27, the data processing agreement under Art. 28 and the record under Art. 30 — are subject to administrative fines of up to EUR 10 million or, in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher (Art. 83(4) GDPR). For infringements of the principles of processing, the conditions for consent and the rights of data subjects, the range is up to EUR 20 million or 4 % (Art. 83(5) GDPR).