Does GDPR apply to US companies?

Three ways in, and none of them is a size test

The GDPR has no revenue floor and no headcount floor. Article 3 sets out who it reaches, and for a company based in the US there are three routes in. Most US firms that end up covered come in through the second.

“Who are in the Union” means where, not who

Art. 3(2) looks at people who are in the EU, whatever their nationality or place of residence (Recital 14). The European Data Protection Board (EDPB) reads it at the moment of the offer or the monitoring. An EU citizen living in Texas who buys from your Texas shop is not the trigger. A visitor to Rome using an app you built for visitors to Rome can be. The EDPB adds that holding data on someone in the EU is not enough by itself: the offer or the monitoring must be there too.

The test runs activity by activity, not company by company. The EDPB says a firm can be under the GDPR for some of its processing and outside it for the rest. Your euro-priced web shop can be in while your US payroll and your US-only sales pipeline stay out.

When you have people over there

An establishment is “the effective and real exercise of activity through stable arrangements”, and the legal form does not matter (Recital 22). For a business that sells online the bar can be low: the EDPB says one employee or agent in the EU may be enough if they act with enough stability. Two limits run the other way. A remote engineer in Lisbon whose work has nothing to do with the processing in question does not pull it in, and a website that people in the EU can open is not an establishment. Nor is an EU representative named under Art. 27.

Is your offer aimed at the EU?

Art. 3(2)(a) turns on intention. Recital 23 asks whether it is apparent that the business envisages offering goods or services to people in one or more EU countries, and it splits the evidence in two. A website people in the EU can reach, an email address or other contact details, or the use of your own country’s language: not enough to show it. A language or currency of an EU country with the possibility of ordering in it, or mentioning customers or users in the EU: may show it.

The EDPB adds a longer list taken from the EU court’s consumer cases (Pammer and Hotel Alpenhof): an EU country named in the offer, paid search or ad campaigns aimed at an EU audience, dedicated EU addresses or phone numbers, an EU or neutral domain such as .de or .eu, travel directions from EU countries, reviews from customers across the EU, and delivery to EU countries. It weighs them together, since several of them alone may not show intention. Goods or services that reach someone in the EU by accident or incidentally do not bring the processing in.

Monitoring needs a purpose, not just a visitor

Art. 3(2)(b) has no intention test written into it. Recital 24 asks whether people are tracked on the internet, including profiling to predict their preferences or take decisions about them. The EDPB reads “monitoring” as collecting and reusing data about someone’s behaviour for a specific purpose, and says not every online collection of data on people in the EU counts automatically. Its list:

• behavioural advertising;
• geo-localisation, in particular for marketing;
• online tracking through cookies or other techniques such as fingerprinting;
• personalised diet and health analytics services online;
• CCTV;
• market surveys and other behavioural studies based on individual profiles;
• monitoring or regular reporting on a person’s health status.

It counts tracking through wearables and smart devices as well. Retargeting pixels and ad audiences built from EU visitors sit squarely on that list. Plain page-view counts are a harder call that turns on what the data is used for afterwards; whether Google Analytics is GDPR compliant walks through the analytics case.

Seven cases the EDPB has already sorted

The EDPB’s guidelines on territorial scope work through numbered examples. These 7 are the ones closest to a US business: 4 land inside the GDPR and 3 stay out. Read the “why” column more than the verdict; it shows which fact carried the decision.

The EU representative under Art. 27

The duty that most often surprises a US firm comes with Art. 3(2). Being caught by it means naming someone in the EU, in writing, who regulators and the people whose data you hold can contact. The EDPB is plain that a business caught by Art. 3(2) that fails to designate one is in breach for that alone.

The narrow way out

Art. 27(2) lifts the duty for public bodies and for processing that meets three conditions at once: it is occasional, it does not include large-scale processing of special-category or criminal-record data, and it is unlikely to result in a risk to people’s rights. The EDPB treats processing as occasional only if it is not done regularly and sits outside the normal course of business, and the test is any risk, not only a high one. A shop that takes orders from Germany every week does not fit. A US firm that once handled a few enquiries from a European trade show might.

Where it sits and what it does

• It must be established in an EU country where the people you sell to or monitor are (Art. 27(3)). The EDPB suggests the country where most of them are, while staying reachable from the others and in their languages.
• It is mandated to be addressed by regulators and individuals on all issues about the processing (Art. 27(4)), and it also keeps your record of processing where one is required (Art. 30(1)).
• Its identity goes in your privacy notice next to yours (Art. 13(1)(a) and 14(1)(a)). The GDPR does not ask you to register it with a regulator.
• One representative covers all your in-scope activities. The role usually runs on a service contract with a law firm, consultancy or company established in the EU.

What it is not

It is not a shield. Naming one is without prejudice to legal action against you (Art. 27(5)), and the EDPB says regulators can serve corrective orders and fines on you through the representative. The representative’s own liability is limited to its record-keeping and to providing information when a regulator asks for it.

The UK asks the same question separately

Since Brexit the UK keeps its own copy of the regulation, the UK GDPR. Its Art. 3(2) runs the same two triggers, offering goods or services and monitoring, for people who are in the United Kingdom. Its Art. 27 asks for a representative in the United Kingdom, with the same exception for occasional, low-risk processing.

The two tests are separate. A US shop that prices in pounds and ships to Leeds can be caught by the UK GDPR without the EU version, and the reverse. Each text asks for a representative on its own territory, so a firm caught by both names one in each; some providers offer both roles. The UK text dropped the EU rule on which country the representative must sit in, and its wording on who addresses the representative was last amended on 30 September 2026, so read the current UK text rather than an older summary.

If you are in: a GDPR list for a US company

Once one activity is in scope, the whole regulation applies to that activity, not a lighter version for foreign firms. In the order a small US team usually works through it:

1. Write down the in-scope activities and keep a record of processing (Art. 30). The exemption for an organisation employing fewer than 250 persons falls away if the processing is not occasional, so a weekly EU order flow brings the record back.
2. Pick a lawful basis for each purpose from the six in Art. 6(1). Notice and an opt-out, the US default, is not one of them.
3. Appoint the representative, then rewrite the privacy notice with the Art. 13 items, the representative’s identity among them. The privacy policy checklist lists every item.
4. Answer rights requests within one month of receipt, extendable by two further months where needed, telling the person within the first month (Art. 12(3)). The DSAR deadline calculator counts the dates.
5. Put an Art. 28 processor contract in place with every vendor that handles the data for you: hosting, email, payments, support desk. A data processing agreement template covers the required terms.
6. Plan for breaches: notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware (Art. 33(1)), and log every breach, notified or not (Art. 33(5)).
7. Check whether you need a DPO. Art. 37(1) requires one in three cases; large-scale monitoring as a core activity is the one an ad-funded US app is most likely to meet.

Questions