Set by the law · GDPR Art. 3(2)
Targeting (offering goods or services, monitoring behaviour)
In plain English
An organisation outside the EU falls under the GDPR if it offers goods or services to people in the EU or monitors their behaviour there. A website merely being reachable from the EU is not enough.
The official text
where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention
In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet
16 decisions on Fino cite Article 3 GDPR. See them →
Related
The official text is quoted word for word from the English version of the source named under it; only the version published in the Official Journal of the EU is legally binding. The plain-English line is Fino’s own summary, not legal advice.