GDPR for US Companies: When It Applies and Where to Start

When GDPR applies to a US company

Under Article 3, GDPR applies to organizations outside the EU when they offer goods or services to people in the EU or the EEA, or when they monitor the behavior of people located there. A US SaaS product with European customers, an ecommerce store that ships to Germany, or an app with European users can all fall in scope. The UK has its own version, the UK GDPR, which follows the same structure.

Having no office in Europe does not remove the obligation. It does affect which supervisory authority you deal with and whether you need an EU or UK representative, which is a question worth checking with counsel.

The principles behind the rules

Article 5 sets the foundation: lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. Accountability means you must be able to demonstrate compliance, not just assert it. Most of the work in practice is building the records that prove it.

The obligations that create the most work

• Lawful basis for each processing activity, such as consent, contract, or legitimate interest, documented before the processing starts
• Records of processing activities under Article 30, which list what personal data you process, why, where it goes, and how long you keep it
• Data protection impact assessments (DPIAs) under Article 35 for high-risk processing, such as large-scale profiling or sensitive data
• Data subject rights, including access, correction, erasure, and portability, with a process that meets the response deadlines
• Vendor contracts with data processing terms under Article 28 for every service that processes personal data for you
• Breach notification to the supervisory authority within 72 hours of becoming aware of a notifiable breach, under Article 33
• International transfers documented with an approved mechanism, such as Standard Contractual Clauses or, where applicable, the EU-US Data Privacy Framework

What is at stake

For the most serious infringements, GDPR fines can reach EUR 20 million or 4% of worldwide annual turnover, whichever is higher. Enforcement is uneven and most regulators prioritize cases involving harm or repeated failures, but a lack of documentation is itself a finding. Enterprise customers in Europe also expect data processing agreements before they sign.

A first 90 days

1. Map your data. Identify personal data by system, purpose, and location, including what your vendors hold.
2. Set lawful bases and write the privacy notice so it matches what you actually do.
3. Create the records of processing and the list of vendors that need data processing agreements.
4. Build the request process for data subject rights and test it once with a real request.
5. Write a breach runbook that includes the 72-hour clock and who makes the notification decision.

GDPR has no certificate to earn

There is no GDPR certification that most companies can obtain to prove compliance. Some organizations use ISO/IEC 27701, a privacy extension to ISO 27001, to structure their program, and that certification can help demonstrate effort. It does not replace the legal analysis.