A US SaaS company can close a deal with a German customer on Friday and face a GDPR questionnaire, an access request, or a regulator inquiry on Monday. That is the commercial reality behind this cross border privacy guide. If your business offers goods or services to people in the EU or monitors their behavior, privacy compliance is not an abstract overseas concern. It is a visible operating requirement that can affect revenue, procurement, customer trust, and regulatory exposure.
The first mistake is treating cross-border privacy as a paperwork exercise. A privacy policy alone does not answer a supervisory authority. A mailing address alone does not assess whether a data subject request was handled correctly. Companies need a structure that assigns responsibility, documents decisions, and gives EU-facing stakeholders a credible point of contact.
When GDPR Applies to a Non-EU Company
Your company does not need an office, subsidiary, employee, or bank account in Europe for the GDPR to apply. The regulation can reach a non-EU business when it offers goods or services to individuals in the EU or monitors their behavior within the EU.
Offering services is broader than charging in euros or translating your website into French. Relevant facts can include shipping to EU countries, running EU-targeted ad campaigns, accepting EU customers, providing localized onboarding, or maintaining a sales strategy for European users. Monitoring can include behavioral advertising, tracking technologies, profiling, location analytics, and other activity used to understand or predict an individual’s behavior.
The analysis is fact-specific. A US company with a handful of accidental EU visitors is in a different position from a company actively selling subscriptions across Germany, France, and the Netherlands. But businesses should not rely on the absence of an EU entity as a defense. That is often the fact that creates the Article 27 representative requirement.
The Cross Border Privacy Guide to Article 27
Article 27 requires many controllers and processors without an EU establishment to appoint an EU Representative in writing. The representative acts as a local contact for supervisory authorities and data subjects on matters related to GDPR compliance.
This requirement is frequently misunderstood. An EU Representative is not simply a name and address to place in a privacy notice. The role must be capable of receiving, assessing, routing, and responding to privacy matters. If an authority contacts the representative about a complaint, breach, processing activity, or missing documentation, passive forwarding creates delay at exactly the moment your company needs control.
A proper appointment should be documented through a signed designation. The representative’s details should appear in the appropriate privacy notices, and internal teams should know how requests will move from the representative to the people who can investigate and approve a response.
There are narrow exceptions. Article 27 may not apply where processing is occasional, does not involve large-scale processing of special-category or criminal-offense data, and is unlikely to create a risk to individuals’ rights and freedoms. Those conditions are cumulative and restrictive. Recurring customer analytics, marketing, e-commerce, app usage, or SaaS account management often makes the “occasional” argument difficult to sustain.
Start With Your Actual Data Flows
Do not begin by copying a competitor’s privacy notice. Begin with the operational facts: what data you collect, why you collect it, where it goes, who receives it, and how long you keep it.
For a typical US business, the relevant flow may start with website analytics or a lead form, move into a CRM, continue through product accounts and support tickets, and end with cloud hosting, payment processing, or marketing platforms. Each transfer, vendor, and retention decision can affect your GDPR obligations.
Your privacy lead, security team, product owner, and legal counsel should be able to answer basic questions without guessing: Which EU residents do we serve? What personal data do we process? Are we a controller, processor, or both? Which vendors process data on our behalf? Do we use data for advertising or profiling? Can we locate and export a user’s information if asked?
If those answers are scattered across teams and vendors, your risk is operational before it is legal. A regulator or enterprise customer will not accept “we are still figuring it out” as a response plan.
Build a Response System Before a Request Arrives
Data subject requests are one of the fastest ways to expose a weak privacy program. An EU individual may request access, correction, deletion, restriction, portability, or information about processing. In many cases, the GDPR response deadline is one month.
That clock does not pause because a request reached a generic inbox, a former employee, or a mailbox provider with no legal review process. A workable system needs intake, identity verification, data collection, legal assessment, response approval, and a documented record of the outcome.
Your process should cover at least five practical controls:
- A designated owner for privacy requests, with a backup decision-maker.
- A method to verify identity without collecting excessive additional data.
- Written instructions for product, engineering, support, and marketing teams.
- A system for locating relevant data across internal tools and service providers.
- An escalation path for high-risk requests, complaints, and regulator correspondence.
Not every request should be granted in full. For example, a deletion request may conflict with legal retention duties, fraud prevention, or another person’s rights. The point is not to promise automatic deletion. The point is to make a timely, legally defensible decision and explain it clearly.
Treat Vendors and Transfers as Contractual Issues
Most US companies rely on cloud infrastructure, analytics tools, customer support platforms, payment providers, and marketing services. That means cross-border privacy compliance is partly a vendor-management problem.
Where a vendor processes personal data on your behalf, you generally need a data processing agreement that addresses the GDPR’s required processor terms. If personal data is transferred from the EU to the United States or another non-EEA country, assess the transfer mechanism and any supplementary measures required by the circumstances.
Standard Contractual Clauses can be relevant, but they are not a magic document that cures every transfer. The right approach depends on the data, the recipient, applicable access risks, technical safeguards, and the roles of each party. Enterprise procurement teams increasingly ask these questions before signing, especially when the vendor handles customer, employee, health, financial, or behavioral data.
Prepare for Incidents, Not Just Audits
A security incident involving EU personal data can create GDPR reporting obligations. Where a personal data breach is likely to result in a risk to individuals’ rights and freedoms, the controller may need to notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it.
The difficult part is rarely finding the 72-hour rule. The difficult part is determining what happened, which data was affected, whether EU residents are involved, what risk exists, and who has authority to make reporting decisions. Those questions need to be addressed under pressure.
Your incident plan should therefore connect security, legal, communications, product, and executive leadership. It should also account for the EU Representative’s role in communications with authorities. A representative that only receives mail is not positioned to help coordinate a credible response when facts are changing by the hour.
Choose Legal Coverage, Not a Mailbox
For companies that need Article 27 coverage, the choice of representative affects more than a line in the privacy notice. A low-cost address service may appear sufficient until a complaint, request, or regulator letter arrives. At that point, message forwarding is not representation.
The stronger model is lawyer-led representation with a clear designation, defined escalation paths, and people who can distinguish routine correspondence from a matter requiring immediate legal attention. rep4eu provides EU Representative coverage through licensed German attorneys, combining formal Article 27 appointment with substantive handling of authority inquiries and data subject request triage.
That distinction matters when a customer asks who represents your company in the EU, when a regulator tests whether your contact point is real, or when an internal team needs fast guidance on a privacy issue that cannot wait for a vendor ticket queue.
Make Compliance Visible Where It Counts
A defensible cross-border privacy program does not require building a full EU legal department overnight. It requires honest scoping, accountable ownership, usable documentation, and qualified representation where the GDPR requires it.
Start with the exposure you already have, not the expansion you may pursue later. If EU residents are already using your product, seeing your ads, submitting forms, or buying from your business, the right time to organize your privacy position is before a deal stalls or a regulator asks why your EU contact is only a mailbox.