Does a VPN change GDPR scope? A checklist, not an IP test

The question usually arrives as whether using a VPN changes GDPR coverage. It is not answerable from an IP address. Coverage follows the processing: who is responsible, in what context, and whose behaviour or offer is involved. Work the checklist below in order and stop at the first item that decides the question for your activity.

A VPN changes the apparent location of a connection. It does not change the controller, the purpose, or the people being targeted.

Check one: who is the controller and where

Name the entity responsible for the processing and any processor acting for it. Record the establishment that decides why and how the data is handled. This is the fact the rest of the analysis hangs on.

If the entity is established in the EU, continue to check two. If not, go to check three.

Check two: is the processing tied to an EU establishment

Article 3(1) covers processing in the context of an EU establishment's activities, even when the processing itself happens outside the Union. The test is the link between the processing and that establishment's activities.

A European office does not automatically pull every operation of a multinational into scope. Equally, routing the traffic through a non-EU exit does not remove the link. The establishment analysis is about the processing, not the packet path.

If this check applies, stop: the VPN exit is irrelevant to coverage, though it may matter to other transfer or security questions.

Check three: offering or monitoring people in the Union

Without an EU establishment, Article 3(2) applies to offering goods or services to people in the Union, or monitoring their behaviour there. Mere accessibility of a website is not enough. The EDPB's Article 3 guidance looks for a deliberate targeting of people in the Union.

The person's presence at the relevant time matters under this route, rather than citizenship or residence alone. An illustrative visitor outside the EU who appears to use an EU IP does not satisfy the location element by that fact alone. What matters is whether the offer or monitoring was aimed at people in the Union. A single visit from an apparent EU address is weak evidence on its own.

If neither establishment nor targeting applies, the VPN exit has not created coverage. If targeting applies, the exit has not removed it.

Check four: what the VPN exit does and does not change

A different exit changes the apparent source of a connection. It may change what a site displays, which is an implementation choice. It does not change who the controller is, what the processing purpose is, or whether the offering was aimed at people in the Union.

Treat geolocation as a limited signal and document the uncertainty. Do not convert an unknown location into an exemption.

Keep the record

For a service operator, record the responsible entity, the establishment, the purpose, the intended audience and any monitoring. Assess the territorial criteria with qualified privacy advice. For an individual, start with the privacy notice and the entity handling your information.

Assess cookie and device-storage rules separately from the Article 3 question. Do not transplant a conclusion from one processing activity to every tracking rule, and do not merge the EU and UK frameworks into one undifferentiated law. The record should say which framework you assessed and why.