A US company can trigger GDPR obligations long before it opens an office in Europe. Selling to EU customers, targeting ads by location, offering an app in European languages or currencies, or tracking EU visitors can be enough. The question is not whether your business is American. It is how to comply with GDPR from the US when your commercial activity reaches people in the EU.
For founders and privacy teams, the practical risk is clear: a missing privacy notice or mishandled access request can become a customer escalation, a stalled procurement review, or a regulator inquiry. GDPR compliance is not a document exercise. It is an operating model for collecting, using, protecting, and responding to issues involving EU personal data.
First, confirm whether GDPR applies to your US business
GDPR can apply to a company with no EU establishment under Article 3 when it offers goods or services to people in the EU or monitors their behavior there. Payment is not required. A free SaaS product, mobile app, newsletter, marketplace, or ad-supported service may still fall within scope.
Offering services is more than having a website that happens to be visible in Europe. Regulators look for signs of intent, such as EU shipping options, EU-focused advertising, country-specific pricing, languages used for EU audiences, or support for EU customers. Monitoring includes behavioral advertising, analytics that build profiles, device tracking, location tracking, and other activity designed to analyze behavior.
Start with a factual data map. Identify which EU residents interact with your company, what personal data you collect, where it enters your systems, which teams can access it, and every vendor that receives it. Include less obvious sources: sales leads, job applicants, trial users, support tickets, product telemetry, cookie data, and marketing audiences.
Do not assume a small EU user base creates a free pass. Scale affects the safeguards expected of you, but it does not automatically remove GDPR coverage. The analysis depends on the nature of your activity and processing, not simply revenue.
Build the compliance foundation before you update the website
A privacy policy matters, but it is only the visible edge of compliance. Your internal practices must support what that policy says. Begin by identifying the role your company plays for each processing activity. In most cases, a business deciding why and how personal data is used is a controller. A vendor processing data solely under a customer's instructions is generally a processor. Some businesses are both, depending on the data flow.
For each controller activity, establish a lawful basis. Consent may be appropriate for some marketing or optional tracking, but it is not the default answer for everything. Contract necessity, legitimate interests, legal obligation, and other lawful bases may apply depending on the purpose. The record should explain why the selected basis fits and what safeguards support it.
Your core compliance package should cover the following operational controls:
- A clear external privacy notice that identifies the controller, purposes, legal bases, retention periods, recipients, international transfers, and individual rights.
- A record of processing activities that documents your data flows and internal ownership.
- Data processing agreements with vendors and, where applicable, customer-facing processor terms.
- A retention schedule that turns broad promises such as we keep data only as long as necessary into actual deletion or review rules.
- Security controls proportionate to the risk, including access management, encryption where appropriate, vendor review, logging, backups, and tested incident procedures.
- A process for responding to access, deletion, correction, objection, portability, and restriction requests within GDPR deadlines.
The point is not to produce paperwork for its own sake. It is to ensure that marketing, product, support, engineering, and legal teams do not make inconsistent decisions about EU data. A policy promising deletion is a liability if no one can locate the data. A consent banner is weak protection if downstream advertising tools continue collecting data regardless of the user choice.
How to comply with GDPR from the US under Article 27
Many US companies subject to GDPR must appoint an EU Representative under Article 27. This requirement applies when a non-EU controller or processor is subject to GDPR under the offering or monitoring rules and has no establishment in the EU.
There is a narrow exception for processing that is occasional, low risk to individuals, and does not involve large-scale processing of special-category data or criminal-offense data. That exception is commonly misunderstood. A recurring SaaS service, eCommerce operation, analytics program, or advertising business is rarely well served by assuming its EU processing is merely occasional. Treat it as a legal assessment, not a self-certification exercise.
Your EU Representative must be established in an EU member state where affected individuals are located. The representative acts as a local point of contact for supervisory authorities and data subjects on matters related to your GDPR obligations. Their details generally need to appear in your privacy notice.
An EU Representative does not replace your own accountability. Your US company remains responsible for its processing decisions, security, vendor management, and legal compliance. Nor is the representative automatically your data protection officer. These are separate roles with different legal functions.
The quality of representation matters when an authority contacts you or a data subject raises a serious complaint. A mailbox provider can forward a message. It cannot assess the request, coordinate a defensible response, identify urgent exposure, or help manage an incident. For companies that need Article 27 coverage, a lawyer-led representative such as rep4eu provides a more credible line of defense than a passive forwarding address.
Treat data subject requests as a business process
GDPR rights requests are time-sensitive. In many cases, you must respond within one month. A request may arrive through support, a generic inbox, a social channel, or your EU Representative. If employees do not recognize it, the deadline can expire before privacy or legal teams even see it.
Create a documented intake and triage path. Verify identity where appropriate, preserve the request, identify the relevant systems, and assign an owner. The response should be complete, intelligible, and recorded. If you need more time because a request is complex or numerous, you must make that decision promptly and communicate it correctly.
Deletion requests deserve particular care. You may have a valid reason to retain some data for legal claims, fraud prevention, accounting, or another lawful purpose. But that is not permission to reject the entire request with a generic response. Separate data that must be retained from data that should be deleted, then explain the result.
Control international data transfers and vendor exposure
EU personal data moving to the United States is a transfer issue, even if your company is otherwise GDPR-compliant. Your contracts and vendor stack need a lawful transfer mechanism. Depending on the circumstances, that may involve an adequacy-based framework, Standard Contractual Clauses, or another permitted route.
This is where compliance becomes technical and commercial. Your cloud provider, CRM, support platform, analytics tools, payroll vendor, and sub-processors may all participate in a transfer chain. Review their contractual terms, security measures, locations, and onward-transfer practices. Procurement teams often ask these questions before signing, and vague answers can delay a deal.
Do not copy transfer clauses into a contract and assume the work is finished. The legal mechanism must match the real data flow. If your documentation says data stays in the EU while US administrators routinely access it, your records do not reflect reality.
Prepare for the event you hope never happens
A personal data breach can require notification to a supervisory authority within 72 hours of awareness when the breach is likely to create risk to individuals. That clock moves quickly. Engineering needs to know how to escalate suspicious activity, while legal and privacy teams need enough facts to assess scope, affected data, likely consequences, and containment.
Run a tabletop exercise. Ask who makes the notification decision, who communicates with your EU Representative, who contacts customers, and where evidence is preserved. A response plan that has never been tested is often just a folder of reassuring language.
GDPR compliance from the US is most manageable when it is treated as a defined business function, not a last-minute answer to a customer questionnaire. Establish ownership, document the decisions that matter, appoint qualified EU representation when required, and make sure a real person can act when Europe calls.