By Prakhar Rai, Founder, My Legal Pal. Advocate, Bar Council of India. LL.B, NLSIU Bangalore. Master of Business Laws.
Quick answer: GDPR applies to a US company in three situations: it has an establishment in the EU whose activities involve personal data, it offers goods or services to people in the EU, or it monitors their behaviour there. A US website that can merely be read from Europe, with nothing aimed at EU users, is generally not covered. If GDPR does apply, you will usually need a privacy notice that meets its standard, a way to handle rights requests, processor contracts, a transfer mechanism, and in many cases an EU representative.
Key takeaways
- GDPR follows the people, not the company’s address. Being based in the US does not take you outside it.
- The test is applied to each processing activity separately, so part of your business can be covered while the rest is not.
- “Targeting” is about intent. Euro pricing, EU shipping, an EU language and EU-aimed marketing point to it. An English-only US site that happens to get EU visitors does not.
- Tracking and profiling people in the EU can bring you in even if you sell nothing to them.
- US vendors that process data for EU customers are bound through contracts, and sometimes by GDPR directly.
- The fines are real: up to 20 million euros or 4% of worldwide turnover for the most serious breaches.
- Other countries have their own versions of the same test, so check where your users are, not only where you are.
If you run a US business and are asking when GDPR applies, the honest answer is “it depends on what you do with people in the EU”, and that is also the answer for companies in India, the UK or anywhere else outside Europe. This guide gives you a test you can run in ten minutes, scenarios to compare yourself against, and what to do next. It covers whether GDPR reaches you. It does not walk through every compliance step, and where we have separate guides, we point to them once.
My Legal Pal is an international team of contract lawyers with US law experience. We are not a US law firm and we are not an EU law firm, so treat this as a practical guide and have counsel in the relevant jurisdiction confirm your position before you rely on it.
The questions we get from US founders are rarely “do we have an EU office”. They are “we added a euro price list and a German landing page, are we in scope now” or “we use a tracking tool, does that count”. The answer usually turns on one point: did you aim at people in the EU, on purpose.
The three ways GDPR reaches a US company
| Trigger | Where it comes from | The question to ask | Typical example |
|---|---|---|---|
| Establishment in the EU | Article 3(1) | Do we have an office, subsidiary, branch or stable arrangement in the EU, and is data processed in connection with it? | A US software company with a German sales office |
| Offering goods or services | Article 3(2)(a) | Are we deliberately offering things to people in the EU, whether or not they pay? | A US online store that ships to France in euros |
| Monitoring behaviour | Article 3(2)(b) | Do we track or profile what people in the EU do? | A US app that analyses how EU users behave and builds profiles |
Only one trigger needs to apply. GDPR is also assessed activity by activity: the European Data Protection Board’s guidelines say that some of your activities being in scope does not bring all of them into scope.
Test 1: Do you have an EU establishment?
The idea of an establishment is broad, and it does not need to be a registered company. The EDPB’s guidelines say a single employee in the EU may count, but also that having an employee there does not by itself trigger GDPR. A website being accessible in the EU is not enough either.
Two limits matter:
- GDPR covers processing carried out in the context of the establishment’s activities, not everything your US parent does.
- If you have a sales rep, an affiliate or a local office in the EU, ask what personal data they handle for you. That is the processing GDPR will look at.
Test 2: Are you offering goods or services to people in the EU?
This is the test most US small businesses meet. It does not require payment. A free app or a free newsletter offered to EU residents counts as an offer.
What counts is whether you meant to target people in the EU. Recital 23 of GDPR says the mere accessibility of a website in the EU is not enough, and points to factors such as the language and currency used and mentions of customers in the EU. The EDPB guidelines add examples.
| Signs you are targeting the EU | Signs that are not enough on their own |
|---|---|
| Prices in euros or another EU currency | A website that EU visitors can open |
| Shipping to EU countries | An English-language site and US dollar pricing only |
| A site translated into an EU language | A contact email address that EU people can use |
| An EU top-level domain such as .de or .eu | An EU visitor who buys once without you seeking EU customers |
| Marketing or ads aimed at people in EU countries | Customers who are EU citizens living in the US |
| Naming EU customers or EU phone numbers on your site |
A single sign rarely decides it. Regulators look at the picture. If your business plan says “expand to Europe”, your marketing says “now shipping to Germany” and your checkout takes euros, you are targeting.
Test 3: Are you monitoring behaviour in the EU?
Even if you sell nothing to anyone in the EU, you can be caught by tracking. Monitoring means following what people in the EU do, for example behavioural advertising, profiling, tracking across sites, and analysing app usage to build profiles. Ordinary web analytics on a site that is not aimed at the EU is a grey area, so look at what the data is used for.
Enforcement against US companies is not hypothetical. In September 2024 the Dutch data protection authority fined Clearview AI, a US company, 30.5 million euros over its facial recognition image database. If you run trackers or ad tools on your site, check what they collect and read our guide on cookie policy drafting.
Scenarios: does GDPR apply to you?
| Scenario | Likely result | Why |
|---|---|---|
| US online store ships to the EU, prices in euros, has a German-language site | Yes | Offering goods to people in the EU |
| US store, English only, dollars only, no EU shipping, a few EU visitors | Probably not | Accessibility alone is not targeting |
| US SaaS company accepts sign-ups from EU users and invoices them | Yes, for those users’ data | Offering services to people in the EU |
| US site with ad trackers that profile EU visitors | Possibly | Monitoring behaviour, depending on use and intent |
| US company with a branch, subsidiary or staffed office in the EU | Yes, for activities of that establishment | Establishment |
| US company with one remote employee in the EU | Depends | A single employee may count as an establishment, but does not by itself trigger GDPR. Tracking that employee may raise a separate question. EU employment law applies regardless |
| US payroll, hosting or analytics vendor serving EU customers | Contractually yes, sometimes directly | Processor duties |
| US B2B company selling to EU businesses | Often yes | Names and work emails of EU staff are personal data |
If you land in “depends”, write down your reasoning. A short internal note showing you considered the test, and why you concluded as you did, helps if a regulator or customer asks.
Processors and vendors
If you process personal data for an EU customer, you are a processor and that customer will insist on a data processing agreement. The EDPB’s guidelines also say a non-EU processor is directly subject to GDPR when its processing connects to a controller’s targeting or monitoring of people in the EU. Their example is a US cloud provider storing data for a US health app that monitors EU users. Where the controller is established in the EU, a non-EU processor is typically bound through the contract and the transfer rules. If you need one, see our service on data processing agreement drafting.
What changes if GDPR applies to you
| Obligation | What it means in practice |
|---|---|
| EU representative | If you are covered under Article 3(2), you generally must appoint a representative in an EU country where your users are. There is a narrow exemption for occasional, small-risk processing that does not involve large-scale sensitive data |
| Lawful basis and notice | You need a lawful reason for each use of data and a clear privacy notice. See privacy policy drafting |
| Rights requests | People can ask for access, correction, deletion and more. You generally have one month to respond |
| Breach notification | Report qualifying personal data breaches to the supervisory authority within 72 hours where feasible |
| Processor contracts | Written contracts with the vendors who handle the data for you |
| Transfers to the US | Data moving from the EU to you needs a valid mechanism, such as the EU-US Data Privacy Framework if you certify, or standard contractual clauses. See our guide to standard contractual clauses |
What can go wrong
GDPR fines have two tiers. The most serious breaches can reach 20 million euros or 4% of worldwide annual turnover, whichever is higher. Other breaches, including failing to appoint a required representative, can reach 10 million euros or 2%. Regulators can also order you to stop processing.
For a US company with no EU assets, the practical pressure often comes from elsewhere. EU customers ask for processor contracts and proof of compliance before they will sign, and a complaint from a single EU user can start an investigation. Do not assume that being far away makes you immune.
What is changing in 2026
- EU-US data transfers. The Data Privacy Framework adopted in July 2023 remains in force. The EU General Court dismissed a challenge to it in September 2025 (Latombe v Commission, T-553/23), and an appeal to the Court of Justice was filed in January 2026. Until that is decided, the framework stands, but keep your standard clauses as a fallback.
- GDPR reform. The European Commission’s Digital Omnibus proposal would change parts of GDPR, including how personal data is defined and the use of data for AI. As of August 2026 nothing had been adopted and the European Parliament was still working through amendments. It does not change the three triggers above.
If you are not in the US: the same test, different local rules
The GDPR test works the same for any company outside the EU. Other countries have their own laws with similar reach, and more than one can apply to you at the same time.
| Law | Reaches companies outside the country when | Note |
|---|---|---|
| UK GDPR | You offer goods or services to people in the UK or monitor their behaviour | A separate regime from EU GDPR, and overseas companies may need a UK representative |
| India, DPDP Act 2023 | Processing outside India is connected to offering goods or services to people in India | Rules were notified on 13 November 2025. The main duties start 18 months after that. See our data protection lawyer in India page |
| Switzerland, revised FADP | The processing has effects in Switzerland | In force since September 2023 |
| Brazil, LGPD | You offer goods or services to people in Brazil or collect data there | Applies regardless of where you are based |
| UAE, federal PDPL | Some processing outside the UAE of data of people in the UAE | Check the DIFC and ADGM free-zone regimes separately |
A ten-minute test you can run
- Do we have an office, employee, agent or subsidiary in the EU, and what data does it handle?
- Do we sell, ship, invoice in euros, translate our site or advertise to people in EU countries?
- Do we track or profile people who are in the EU, for ads or analytics?
- Do we handle data for a customer in the EU, as a vendor?
- Where are our users, and which other countries’ laws might reach us?
If you answer yes to any of the first four, assume GDPR applies to that activity and plan accordingly. If you are unsure, write down why.
Get help with your position
If you want a lawyer to review whether GDPR or another privacy law applies to your business, and what to put in place, our team handles data protection and privacy work for companies outside the EU.
Quick answers
Does GDPR apply to a US company with no EU office? It can. GDPR applies if you offer goods or services to people in the EU, or monitor their behaviour there, even without an office. A website that EU visitors can merely open is not enough.
Does GDPR apply if I only have a few EU customers? The number is not the test. If you deliberately target people in the EU, GDPR applies to that activity even with a small number of customers. If an EU customer found you by chance and you did nothing to seek them, it may not.
Do I need an EU representative? Generally yes if you are covered under Article 3(2), unless the processing is occasional, does not involve large-scale sensitive data and is unlikely to risk people’s rights. The representative must be in an EU country where your users are.
Does GDPR apply to a B2B company? It can. Names, work emails and job titles of people at your customers are personal data. If you sell to EU businesses or process their staff’s data, check the tests above.
Can the EU actually fine a US company? Yes, and has. A Dutch regulator fined a US company 30.5 million euros in 2024. Collecting from a company with no EU assets is harder, but orders, investigations and customer pressure still apply.
Is the EU-US Data Privacy Framework still valid? Yes. A challenge was dismissed by the EU General Court in September 2025 and an appeal was filed in January 2026. It remains in force while that is decided.
Does being GDPR compliant mean I comply with UK or Indian law too? Not automatically. The UK, India and other countries have separate laws with their own rules, though a GDPR-ready programme gives you a head start.
A note on who we are
My Legal Pal is an international team of contract lawyers with US law experience. We aren’t a US law firm, and we aren’t a local firm in every country mentioned above. This article is general information and not legal advice on your facts. Have a lawyer qualified in the governing jurisdiction check the details before you act.
About the author. Prakhar Rai is an advocate enrolled with the Bar Council of India and the founder of My Legal Pal. He holds an LL.B from NLSIU Bangalore and a Master of Business Laws, and works on contract drafting, review and disputes for founders and businesses across borders. Full profile
