The report on the extraterritorial enforcement of the GDPR examines the extent to which the GDPR can be effectively enforced by Data Protection Authorities (DPAs) against entities that fall under the scope of the GDPR but are established outside of Europe. In addition, this report analyses the conditions under which judgments and decisions delivered in the EU could be recognised and enforced outside this territory.

The EDPB commissioned this report as part of the Support Pool of Experts programme, which aims to support cooperation among DPAs by providing expertise and tools related to enforcement. This project was launched at the request of the Dutch DPA.

Project conducted by external expert Helena Kastlová and completed in April 2024.

Objective: this project provides the DPAs with a comprehensive picture with regard to the possibilities of extraterritorial enforcement. In addition, this report focuses on the potential enforcement actions by DPAs outside of the EU, the exercise of investigative powers and the recognition and enforcement of decisions established in court.