Under public international law, a State has a right to exercise jurisdiction. States are expected to show restraint when attempting to regulate a situation with foreign elements. The research outlines territory- and personality-based permissive principles of jurisdiction. EU data protection provisions that lend themselves to extraterritorial application fall into the subjective territoriality, objective territoriality, passive personality, effects doctrine and potentially protective principles of jurisdiction. The provisions do not come under any one of these principles, but rather an interpretation of several of them. The applicable law articles in the General Data Protection Regulation could most plausibly constitute the objective territoriality (where an act is terminated) and passive personality (the nationality of a victim) principles. Whilst there appears to be a shift from territory to personality, for example, by referring to data processing in the context of activities ‘in the Union’ or individuals ‘subject to the jurisdiction of’ rather than data processing in the context of the activities ‘on the territory of a Member State’ or ‘in the territory of’ each state party’, to justify the exercise of jurisdiction, territory is still necessary to trigger the application of jurisdiction in the online sphere.