Simply being applicable could still permit far too much in terms of the extraterritorial reach of the EU’s data protection laws. The law of jurisdiction cannot solve all the present issues. It helps to solve conflicts in terms of sovereignty, but not fundamental rights. As such, this warrants a second-tier, additional set of criteria including degree of connection and interest-balancing as a rule of reason. The degree of connection between a regulated situation and the regulator, and interest-balancing are useful in assessing the legitimacy of the EU’s exercise of extraterritorial jurisdiction in the internet age, which throws traditional concepts of territoriality into question. Flowing from this, a rule of reason transpires. A State may legitimately exercise jurisdiction where it has an obligation to do so to protect a fundamental right, based on a permissive principle exercised reasonably, that is, after regulators have balanced different interests to identify the State with the strongest interest in regulating the situation, unless this harms the global interest.