# CJEU, judgment of 1 October 2015, C-230/14, Weltimmo Broad interpretation of the concept of an establishment for the purposes of the territorial scope: a stable arrangement with minimal but real activity suffices. > Quelle: https://www.thomashelbing.com/en/wissen/dsgvo-hub/rechtsprechung/1.4.42-eugh-weltimmo > Sprache: en ## 1. Overview [#1-overview] A company established in Slovakia operated a website for the brokerage of real estate that was directed at the Hungarian market and, in doing so, processed personal data of the advertisers. The Court had to clarify under what conditions the data protection law of a Member State applies by reference to the place of establishment. Reference: [CJEU, judgment of 1 October 2015, C-230/14, Weltimmo](https://curia.europa.eu/juris/liste.jsf?num=C-230/14\&language=de) ## 2. Broad concept of an establishment [#2-broad-concept-of-an-establishment] The concept of an establishment is to be interpreted broadly and on the basis of a flexible, non-formalistic conception. It covers any real and effective activity exercised through stable arrangements, even where that activity is minimal. The legal form of the arrangement, entry in a register and whether it constitutes a legal person are all irrelevant. What is required is an interplay of human and technical resources with a certain degree of stability. ## 3. Relevant indications in the case [#3-relevant-indications-in-the-case] The Court held that a relevant activity was being exercised because the operator had appointed a representative in the Member State concerned who negotiated with customers about outstanding debts, because it ran a website in the national language and because it maintained a bank account for the recovery of debts as well as a letter box. It follows that, depending on the nature of the activity, the presence of a single representative may already suffice. Conversely, a mere server, a letter-box company or the mere accessibility of a website do not in themselves constitute an establishment. ## 4. Significance for Article 3(1) GDPR [#4-significance-for-article-31-gdpr] The decision shapes the understanding of the [establishment criterion](/docs/dsgvo-hub/einzelthemen/anwendungsbereich-der-dsgvo/1.3.1.2-raeumlicher-anwendungsbereich), which is carried over into Article 3(1) GDPR. It shows that even a minimal but real activity in a Member State may bring the territorial scope into play. ## 5. Limits of the supervisory powers [#5-limits-of-the-supervisory-powers] At the same time, the Court emphasized the limits of the powers of national supervisory authorities: a supervisory authority may impose penalties only within the territory of its own Member State. --- ## About the author This article was written by [Dr. Thomas Helbing, specialist lawyer for IT law in Munich](https://www.thomashelbing.com/en). Since 2020 and continuously through today (2026), Handelsblatt has [recognized](https://www.thomashelbing.com/en#auszeichnungen) Dr. Helbing as one of **"Germany's Best Lawyers"** in IT law and data protection law. According to Kanzleimonitor.de (2024 to 2026 editions), he ranks among the **leading lawyers for data protection and IT law** and is listed among the **top 100 lawyers in Germany (2024/25)**. Kanzleimonitor is considered a particularly meaningful market study because it is based exclusively on personal recommendations from in-house counsel. Dr. Helbing has **many years of advisory experience in data protection and IT law** and advises clients of all sizes, from startups through fast-growing SaaS companies and unicorns to international corporate groups. His [professional background](https://www.thomashelbing.com/en#stationen) covers the **full spectrum of IT and technology law practice**. He began his career at a major international law firm, then gained **in-house experience at a DAX-listed company**, and is himself an **entrepreneur and founder of several digital ventures**. He also has **hands-on programming experience**, which allows him to understand technical systems, software architectures and digital business models not only from a legal perspective but also from a technical one. For many years, his [clients](https://www.thomashelbing.com/en#referenzen) have included **technology companies and SaaS providers**, leading **German research institutions** and a **systemically important German bank**. His advisory focus lies in particular on **GDPR compliance, the data economy, SaaS, AI regulation and IT contract law**.