A US company can have no office, employees, or servers in Europe and still face GDPR obligations. That is why the question is not whether your business is physically based in the EU. The question is whether you can document GDPR territorial scope with facts that match how you market, sell, and process data.
For a SaaS company with EU customers, an ecommerce brand shipping to France, or an app that profiles users in Germany, a vague statement that the GDPR “may apply” is not enough. Procurement teams, customers, investors, and regulators expect a defensible answer. Your records should show the legal conclusion, the operational facts behind it, and the actions your company took as a result.
GDPR territorial scope starts with Article 3
GDPR Article 3 determines when the Regulation applies. It has two primary routes that matter to non-EU businesses.
First, the GDPR applies where processing occurs in the context of an establishment in the EU. “Establishment” is broader than a subsidiary or incorporated entity. It can include stable and effective activity through personnel, offices, or other arrangements in the EU. A company should not assume that a small European sales presence or regular local operations are irrelevant just because its headquarters are in the United States.
Second, Article 3(2) extends the GDPR to companies without an EU establishment when their processing relates to offering goods or services to people in the EU, or monitoring their behavior in the EU. This is the route that catches many US-based companies.
The location of your servers is not the deciding factor. Neither is the customer’s citizenship. A US citizen traveling in Spain may be within the relevant territory while using your service, while an EU citizen located in the United States may not trigger the same analysis. The focus is on individuals who are in the EU and on the company activity connected to them.
How to document GDPR territorial scope correctly
A useful territorial-scope assessment is not a one-line legal conclusion. It is a short, evidence-backed record that a compliance lead, attorney, regulator, or enterprise buyer can understand without guessing how your business operates.
Start with the commercial facts
Map the products, services, and marketing activities that could reach people in the EU. Include your website, mobile apps, sales channels, customer support, advertising, payment flows, and analytics tools. Then identify where users are located when they interact with those activities.
For example, a US software vendor may have customers worldwide but actively pursue German and Dutch business through paid campaigns, EU-focused case studies, local currency pricing, and sales outreach. Those facts carry more weight than a generic statement that the service is available online worldwide.
Your analysis should also identify which entities process the data. A parent company, operating company, and US-based affiliate may have different roles. If one entity controls the purpose and means of processing EU prospect or customer data, that entity needs to be named clearly in the assessment.
Test whether you offer goods or services in the EU
The GDPR does not apply merely because an EU resident can find your website. Passive accessibility is different from directing commercial activity toward people in the Union.
Document the indicators that point toward, or away from, EU targeting. Relevant facts can include EU member state shipping, euro pricing, translated pages aimed at EU markets, country-specific advertising, EU reseller arrangements, sales teams pursuing EU accounts, or terms that refer to EU customers. A .eu domain alone does not decide the issue, and neither does English-language content. The overall commercial picture matters.
If you conclude that you are not targeting the EU, preserve the facts that support that conclusion. For example, you may block EU shipping, exclude EU countries from campaigns, decline EU orders, and avoid EU-specific market positioning. But those controls need to be real. A checkout page that accepts German billing addresses will undermine a claim that your business does not offer services in Germany.
Test whether you monitor behavior in the EU
Monitoring is more than basic website measurement, but it can include behavioral profiling, targeted advertising, location tracking, predictive analytics, and other processing designed to analyze or forecast a person’s behavior.
The right question is not simply, “Do we use cookies?” Ask what the data is used to do. A tool used only for aggregated, limited traffic statistics may present a different analysis from a platform that builds individual profiles, scores leads, tracks cross-site activity, or retargets users based on their behavior.
Record the vendors involved, categories of data collected, whether identifiers are linked to individual users, and how the output affects advertising, recommendations, pricing, fraud detection, or other decisions. This makes the assessment operational rather than theoretical.
Write a clear conclusion and owner
Your final record should state whether Article 3 applies, which processing activities are in scope, the legal basis for that conclusion, and the date of review. It should identify the person or team responsible for maintaining it.
Avoid hedged language that solves nothing, such as “the GDPR might apply depending on circumstances.” There may be genuine uncertainty at the margins, but the company still needs a working decision. If the facts support applicability, say so and document the resulting obligations. If they do not, explain the controls and assumptions behind the conclusion.
Evidence should match your public-facing reality
A territorial-scope file becomes valuable when it can withstand scrutiny. A privacy notice that claims no EU offering, while the sales team is booking demos with French prospects, creates an avoidable credibility problem.
Keep the evidence that supports your assessment in one place. This may include screenshots of localized pages and advertising settings, sales territory rules, country availability settings, shipping restrictions, product configurations, analytics documentation, and internal decision records. It should also include a current description of relevant processing activities and the legal entities involved.
This does not need to become a 70-page memo for every startup. The right level of detail depends on the scale, risk, and complexity of your EU activity. A self-service app with a handful of EU users may need a concise assessment. A growth-stage company selling to European enterprises should expect deeper documentation because customers and procurement teams will ask harder questions.
The key is consistency. Your territorial-scope analysis should align with your privacy notice, records of processing, data processing agreements, cookie practices, and sales claims. Contradictions are often more damaging than an imperfect first draft because they suggest the company has not controlled its compliance position.
Article 27 is a separate decision, not a footnote
Once a non-EU company determines that Article 3(2) applies, it must assess the EU Representative requirement under GDPR Article 27. In many cases, appointing an EU Representative is mandatory for a controller or processor without an EU establishment that offers goods or services to people in the EU or monitors their behavior there.
There are limited exceptions. One often cited exception concerns processing that is occasional, unlikely to create a risk to individuals’ rights and freedoms, and does not involve large-scale processing of special-category or criminal-offense data. Those conditions are cumulative and narrow. A company with continuing EU customers, recurring marketing activity, or meaningful analytics should not treat the exception as an automatic escape route.
Document that analysis separately. Your file should state whether an Article 27 representative is required, whether an exception is being relied upon, and why. Do not confuse an EU Representative with a data protection officer. They have different legal roles, and appointing one does not eliminate the need to assess the other.
If a representative is required, the appointment should be formal, current, and visible in your privacy documentation. A mailbox provider that merely forwards messages may leave the company exposed when a supervisory authority asks substantive questions or a data subject submits a complex request. An EU Representative should be able to receive communications, coordinate a response, and help maintain an orderly regulatory record. For companies that need lawyer-led Article 27 coverage, rep4eu provides that function across all 27 EU member states.
Review scope when the business changes
Territorial scope is not a document you prepare once and file away. Reassess it when you enter a new market, add EU shipping, launch localized pricing, begin EU ad campaigns, acquire a company with European users, change analytics providers, or introduce profiling features.
Set a review cadence that fits the business, usually at least annually and whenever a material commercial or product change occurs. The review should involve legal, privacy, product, marketing, and sales where relevant. Legal teams can interpret Article 3, but they cannot assess facts they have not been told about.
A credible GDPR position begins with an honest account of what your company is actually doing. Document the scope before a customer questionnaire, complaint, or regulator forces the issue. That gives the business room to make deliberate choices instead of defending avoidable gaps under pressure.