Does GDPR Apply to US Companies? A Complete Compliance Guide

If your US-based business collects, stores, or processes data belonging to people in the European Union, the General Data Protection Regulation (GDPR) applies to you — regardless of where your servers are located or whether you have a single employee on European soil. Ignore it, and you face fines of up to €20 million or 4% of your annual global turnover, whichever is higher. This guide cuts through the legal complexity and tells you exactly what US companies need to know and do to stay compliant.

Not sure what GDPR actually is? Read our plain-English guide to GDPR before diving in.

The Short Answer: When Does GDPR Apply to US Businesses?

The GDPR’s territorial scope is set out in Article 3 of the regulation, and it is deliberately broad. You do not need a registered office in Paris or Frankfurt for the GDPR to reach you. There are two triggers that bring a US company into scope.

1. Offering Goods or Services to EU Residents

If your website accepts payments in Euros, ships physical products to EU addresses, displays pricing in local European currencies, or is available in EU languages with content aimed at EU audiences, you are offering goods or services to EU residents. That is enough to trigger GDPR compliance obligations, even if you never intended to target European customers and have no EU-based staff.

2. Monitoring the Behaviour of Individuals in the EU

This is where many US companies are caught off guard. If your website uses tracking cookies, Google Analytics, Meta Pixel, retargeting tools, or behavioural advertising platforms that collect data on EU visitors — even passively — you are monitoring the behaviour of individuals in the EU. The GDPR applies to you. You do not need to be actively selling to Europeans; simply observing their online behaviour is sufficient to bring you within scope.

Does Company Size Matter for GDPR Compliance?

Unlike several US privacy frameworks that exempt small businesses beneath a certain revenue or data-volume threshold, the GDPR contains no such carve-out based on company size. A US startup with five employees that runs a SaaS product used by customers in Germany faces the same core obligations as a Fortune 500 corporation.

There is one limited exception: organisations with fewer than 250 employees are not required to maintain full written records of their processing activities unless the processing is likely to result in a risk to the rights of individuals, is not occasional, or involves sensitive personal data. In practice, most businesses that handle EU customer data will not qualify for this partial exemption. Wondering what GDPR compliance actually costs? We have broken that down separately.

Data Controller vs. Data Processor: What Is Your US Company’s Role?

One of the most practically important distinctions in the GDPR is the difference between a Data Controller and a Data Processor. Getting this wrong leads to misunderstanding your legal obligations.

A Data Controller is the entity that determines the purposes and means of processing personal data. If your US business collects email addresses from your website visitors to send them marketing, you are the Controller. You decide why the data is being collected and how it will be used. Controllers carry the heaviest GDPR obligations — they must establish a lawful basis for processing, respond to data subject requests, and ensure their vendors are contractually bound to protect the data.

A Data Processor is an entity that processes personal data on behalf of a Controller. If you run a US-based SaaS platform and your clients are European businesses that load their own customer data into your system, you are acting as a Processor. You do not decide the purpose of the processing — your European client does. Processors must act only on the Controller’s documented instructions, implement appropriate security measures, and sign a formal Data Processing Agreement (DPA).

It is also possible to be both simultaneously. A US company may be a Controller for its own marketing data while acting as a Processor for its enterprise clients’ data. Understanding which role applies in each context is essential for structuring your compliance programme correctly.

Key GDPR Requirements for American Companies

The GDPR places a wide range of obligations on organisations that fall within its scope. Below are the requirements that matter most in practice for US-based businesses.

Lawful Basis and Explicit Consent

You cannot simply collect and use personal data because it is useful to your business. The GDPR requires every processing activity to rest on one of six lawful bases: consent, contract, legal obligation, vital interests, public task, or legitimate interests. For most US companies dealing with marketing and analytics, consent and legitimate interests are the most relevant bases.

When relying on consent, it must be freely given, specific, informed, and unambiguous. Pre-ticked boxes, bundled consent buried in terms and conditions, and implied consent through inactivity are all invalid under the GDPR. Individuals must also be able to withdraw their consent as easily as they gave it. This has direct implications for your email marketing lists, cookie banners, and sign-up forms.

Fulfilling Data Subject Rights (DSARs)

The GDPR grants EU residents a robust set of rights over their personal data, and your organisation must have processes in place to honour them. These rights include the right to access their data, the right to correct inaccuracies, the right to erasure (the “right to be forgotten”), the right to restrict processing, the right to data portability, and the right to object to processing — including for direct marketing purposes.

When a Data Subject Access Request (DSAR) arrives, you have one calendar month to respond. Failing to respond, or responding with incomplete information, can trigger a complaint to a supervisory authority and potential enforcement action. US companies frequently underestimate the operational burden of DSARs, particularly if personal data is scattered across multiple systems, CRMs, and email platforms.

The 72-Hour Data Breach Notification Rule

If your organisation experiences a personal data breach — whether through a cyberattack, an employee error, or a third-party vendor incident — the GDPR requires you to notify the relevant EU supervisory authority within 72 hours of becoming aware of it. If the breach poses a high risk to the rights and freedoms of affected individuals, you must also notify those individuals directly without undue delay.

Your breach notification to the supervisory authority must include a description of the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures you have taken or propose to take. Having a well-rehearsed data breach response plan and documentation in place before an incident occurs is not optional — it is a core part of demonstrating accountability under the GDPR.

Appointing a DPO and an EU Representative

Many US companies focus on the Data Protection Officer (DPO) requirement but overlook a separate — and equally important — obligation: appointing an EU Representative under Article 27 of the GDPR.

A Data Protection Officer (DPO) is required when your core activities involve large-scale, systematic monitoring of individuals, or large-scale processing of special category data (such as health, biometric, or religious data). The DPO acts as an internal champion for data protection, advises on compliance, and serves as the point of contact for supervisory authorities. You can appoint an in-house DPO or engage an outsourced DPO service. Learn more about the role and responsibilities of a Data Protection Officer.

An EU Representative is a separate requirement that applies specifically to organisations based outside the EU that are subject to the GDPR. Unless your processing is occasional, low-risk, and does not involve special category data, you are required under Article 27 to designate a named representative based within the European Union. This person or entity acts as a local point of contact for EU supervisory authorities and data subjects. Failing to appoint an EU Representative is itself a GDPR violation and can result in fines of up to €10 million or 2% of global annual turnover.

Fines and Enforcement: How Does the EU Penalise US Companies?

The GDPR operates a two-tier fine structure. The lower tier, for less serious infringements such as failing to maintain proper records or appointing an EU Representative, carries fines of up to €10 million or 2% of annual global turnover. The upper tier, for the most serious violations such as unlawful processing or breaching data subject rights, carries fines of up to €20 million or 4% of annual global turnover — whichever is the higher figure in each case. For full detail on how fines are calculated, see our dedicated guide to GDPR fines and penalties.

Can the EU Actually Enforce Fines Against US Companies?

This is the most common question US business owners ask — and the answer is: yes, more effectively than most assume.

First, if your US company has any European assets, bank accounts, subsidiaries, or business partners, those assets can be subject to enforcement action by EU regulators or national courts cooperating with supervisory authorities. Second, many countries have bilateral judicial cooperation treaties that can facilitate cross-border enforcement. Third — and most practically — if you wish to continue operating in the EU market, you cannot simply ignore a fine. EU supervisory authorities can ban your organisation from processing data belonging to EU residents, effectively prohibiting you from doing business in Europe at all.

US technology giants have demonstrated that EU enforcement reaches beyond borders in practice. Amazon was fined €746 million by Luxembourg’s data protection authority. Meta has faced fines exceeding €1.2 billion. Google has been sanctioned repeatedly across multiple EU member states. None of these companies are EU-headquartered, yet the fines were issued and pursued. The EU’s enforcement apparatus is expanding, and smaller US companies should not assume they will escape scrutiny.

GDPR vs. US Privacy Laws (CCPA and CPRA)

For US companies already navigating California’s Consumer Privacy Act (CCPA) or its successor the California Privacy Rights Act (CPRA), it is tempting to assume that CCPA compliance means GDPR compliance. It does not.

There are meaningful overlaps — both frameworks grant individuals rights over their data, require privacy notices, and impose data security obligations. However, the GDPR goes further in several important areas. The GDPR requires a positive lawful basis for every processing activity before it begins; the CCPA operates primarily on an opt-out model. The GDPR’s consent requirements are significantly stricter. The GDPR mandates Data Processing Agreements with all vendors who handle personal data on your behalf, not just certain categories. And the GDPR’s requirements around data breach notification, data subject rights, and accountability documentation are considerably more detailed.

If you are already CCPA-compliant, you have built a useful foundation — but you will need to layer additional controls on top to achieve GDPR compliance for your EU data subjects.

The EU-US Data Privacy Framework: What US Companies Need to Know

One of the most pressing practical challenges for US companies subject to the GDPR is the question of international data transfers. Under the GDPR, personal data cannot be transferred from the EU to a third country — including the US — unless that country is deemed to provide an adequate level of protection, or unless specific safeguards are put in place. This is where the EU-US Data Privacy Framework (DPF) comes in.

What Is the EU-US Data Privacy Framework?

The EU-US Data Privacy Framework is a self-certification programme that allows eligible US organisations to receive personal data transferred from the EU without needing to put in place additional transfer mechanisms such as Standard Contractual Clauses (SCCs). The European Commission adopted an adequacy decision for the EU-US DPF on 10 July 2023, determining that the additional safeguards in place provide an adequate level of protection for personal data transferred from the EU to the US.

The DPF is the third attempt to regulate transatlantic data flows, following the invalidation of the EU-US Safe Harbor framework in 2015 and the EU-US Privacy Shield in 2020. Both predecessors were struck down by the Court of Justice of the European Union (CJEU), primarily due to concerns about US government surveillance and insufficient redress mechanisms for EU data subjects.

How Does Self-Certification Work?

To rely on the DPF as a transfer mechanism, a US organisation must self-certify its compliance with the DPF Principles through the US Department of Commerce. To join the Data Privacy Framework, a company must self-certify to the Department of Commerce that it complies with the Data Privacy Framework Principles. Failure to comply with those Principles after self-certifying may be treated as a violation of the FTC Act’s prohibition on unfair and deceptive practices, and the FTC is committed to vigorous enforcement.

Once certified, the organisation’s name appears on the publicly searchable DPF list maintained by the Department of Commerce. EU businesses transferring personal data to a DPF-certified US organisation can do so without conducting a separate transfer impact assessment. Organisations transferring personal data to DPF-certified importers do not need to carry out transfer risk assessments, because the DPF benefits from an adequacy decision.

The DPF also covers transfers to the UK (via the UK Extension to the EU-US DPF) and Switzerland (via the Swiss-US DPF), providing a single certification pathway for US companies managing data flows from multiple jurisdictions.

Important: The DPF Does Not Replace Full GDPR Compliance

A critical point that many US companies misunderstand: certifying under the DPF only addresses the legality of the data transfer itself. It does not replace or substitute for the full range of GDPR obligations. You still need lawful bases for processing, valid consent mechanisms, DSAR procedures, a compliant privacy notice, DPAs with sub-processors, and all other GDPR requirements. The DPF and the GDPR operate on different layers — the DPF unlocks the pipeline; the GDPR governs everything that happens once the data flows through it.

The DPF Is Not Without Risk: What US Companies Should Watch

The DPF’s two predecessors were both invalidated by the CJEU, and the current framework faces real political and legal uncertainty. US companies that rely solely on DPF certification for their EU data transfers should be aware of the following risks.

Ongoing legal challenges. The EU General Court dismissed a challenge to the DPF in September 2025, but made clear its decision was based on the facts and law as they stood at the time of the adequacy determination in July 2023, and did not address subsequent developments under the Trump administration. NOYB — the privacy advocacy organisation that brought down both Safe Harbor and Privacy Shield — has indicated it is reviewing options for a broader legal challenge.

Political uncertainty under the current US administration. Changes to the US Privacy and Civil Liberties Oversight Board (PCLOB) and the Federal Trade Commission are driving concerns about the DPF’s validity — both entities play crucial roles in carrying out the redress mechanism that underpins the framework, and the removal of independent members from both bodies raises questions about whether the oversight structure the EU relied upon still operates as intended.

What this means for your business. If you rely on the DPF for EU-to-US data transfers, you should not treat it as a permanent or guaranteed solution. Prudent compliance programmes maintain Standard Contractual Clauses (SCCs) as a parallel or fallback mechanism. SCCs are contractual safeguards approved by the European Commission that do not depend on a political adequacy decision — meaning they remain valid even if the DPF were to be struck down. Our GDPR document templates include ready-to-use SCC documentation, and our GDPR compliance service can help you assess which transfer mechanisms are appropriate for your specific data flows.

Does GDPR Apply to US Citizens?

This question comes up frequently, and the answer surprises many people: the GDPR is location-based, not citizenship-based.

The GDPR protects individuals who are present in the EU at the time their data is collected or processed, regardless of their nationality. A US citizen who lives and works in Berlin is covered by the GDPR. An EU citizen who has moved to New York and is shopping on a US-only website with US pricing is generally not covered. What matters is not the person’s passport, but their physical location at the point of data collection.

In practice, this means that if you run a US e-commerce store that ships to Germany, you need to treat German customers’ data under GDPR — whether those customers are German nationals, American expats, or anyone else. The data subject’s location at the time of collection is what determines applicability. You can find out more about which countries are covered by the GDPR in our dedicated guide.

6-Step GDPR Compliance Checklist for US Businesses

If you are starting your GDPR compliance journey or conducting a review, these six steps form the practical backbone of any compliance programme. For a detailed assessment of where your business currently stands, our GDPR Gap Analysis service maps your current practices against regulatory requirements.

1. Conduct a Data Mapping Audit. Identify every category of personal data you collect, where it comes from, where it is stored, who has access to it, and how long you retain it. You cannot protect data you do not know you hold. This is the essential first step and feeds into all other compliance work.
2. Update your Privacy Policy. Your privacy notice must tell EU data subjects what data you collect, the lawful basis for processing it, how long you keep it, who you share it with (including any US-based third-party vendors), and how they can exercise their rights. Generic, boilerplate privacy policies copied from US templates seldom meet GDPR standards.
3. Implement a compliant Cookie Consent Banner. If your website uses non-essential cookies — analytics, advertising, personalisation — you need a cookie consent mechanism that obtains prior, informed consent before those cookies fire. Consent must be recorded and withdrawable. Banners that pre-tick boxes or load analytics before the user clicks “Accept” do not comply.
4. Sign Data Processing Agreements (DPAs) with all relevant vendors. Every third-party vendor that processes personal data on your behalf — your email marketing platform, CRM, cloud storage provider, payment processor, or analytics tool — must have a signed DPA in place. Review your vendor stack and chase down any missing agreements. Our GDPR document templates include a ready-to-use DPA template.
5. Appoint an EU Representative and, where required, a DPO. Determine whether your processing activities require a Data Protection Officer. Regardless of the DPO question, most US companies processing EU personal data will need to appoint an EU Representative under Article 27. This is a named individual or organisation based in the EU whose details are published in your privacy notice and provided to supervisory authorities on request.
6. Establish a Data Subject Access Request (DSAR) protocol. Create a documented, tested process for receiving and responding to DSARs within the one-month deadline. This includes verifying the identity of the requester, locating all data held across your systems, and producing a clear, complete response. Invest in staff training so that everyone who might receive a DSAR — including customer service and sales teams — knows what to do and who to escalate to.

How GDPR Advisor Can Help Your US Business Achieve Compliance

Navigating GDPR compliance from the US is genuinely complex — but it does not have to be overwhelming. GDPR Advisor works with US-based businesses at every stage of the compliance journey, from initial assessment through to ongoing advisory support.

Our services most relevant to US companies include:

• GDPR Compliance Audit — A thorough review of your current data processing practices, policies, and technical controls, with a clear action plan to close gaps.
• GDPR Gap Analysis — Quickly identify where your organisation falls short of GDPR requirements and prioritise your remediation roadmap.
• Outsourced DPO Service — Access qualified, experienced data protection expertise without the cost of a full-time hire. Our outsourced DPO service can also serve as your designated EU Representative where appropriate.
• GDPR Staff Training — Equip your team with the knowledge to handle personal data responsibly, respond to DSARs, and recognise data breach risks before they escalate.

Ready to take action? Contact us today to book a no-obligation consultation and find out exactly what your US business needs to do to operate compliantly in the EU market.

Frequently Asked Questions