This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behavior as far as their behavior takes place within the Union.
Chapter I, Article 3, Paragraph 2
Regulation's subject matter
Territorial scope (Article 3, Chapter I)
Scope of application
Controller not established in the EU Data subject in the Union Processor not established in the EU