Since the EU Charter of Fundamental Rights, which enshrines an autonomous right to data protection, gained binding legal effect in 2009, the right has gained broader territorial reach, become more prominent in jurisprudence and accorded more weight in balancing tests. Under international human rights law, the EU’s protective duty could apply in the a-territorial cybersphere in which data is processed. The Union has positive and negative obligations to respect, protect and fulfil its individual’ fundamental right to data protection. These are obligations of conduct and result, and apply within different spaces. The obligation to respect connotes a negative obligation of conduct, whereby the EU would have to refrain from conduct that would infringe upon someone’s enjoyment of the right to data protection. Similarly, the obligation to protect is a positive one of conduct, so the EU would be obliged to ensure a third party does not violate someone’s right to data protection. These obligations could legitimately apply outside EU territory or in places under its effective control. International human rights law casts a very wide jurisdictional net, however. This net per se would not serve to lessen transatlantic conflicts in jurisdiction, so public international law can offer some necessary limitations.