A US software company can launch a translated pricing page on Monday and have EU signups by Tuesday. What it cannot do is assume that its US legal stack travels with it. The first enterprise prospect may ask for a GDPR addendum. A consumer may invoke a withdrawal right. A regulator may send an inquiry to the EU contact named in the privacy notice. If no one is prepared to answer, a promising market entry becomes an exposed compliance event.
Selling into Europe legally is not one filing, one policy, or one badge in a website footer. It is a set of obligations that changes based on what you sell, where your customers are located, how you reach them, and what personal data you collect. For US companies, the commercial question is straightforward: can you accept EU revenue without creating a gap that blocks procurement, invites complaints, or leaves regulators with no credible point of contact?
Start with the activity, not your company address
The European Union is not a single legal code for every commercial issue. EU regulations create common baselines, while member states add national requirements in areas such as consumer enforcement, taxes, employment, product rules, and marketing. Germany, France, Italy, and the other member states are not interchangeable markets simply because they use the euro or participate in the single market.
Still, a non-EU company does not need a European subsidiary before it can sell to European customers. The right question is whether your specific activity triggers obligations. A B2B SaaS vendor selling to a German company, a US ecommerce brand shipping to consumers in France, and a mobile app monitoring users across several EU countries face materially different risk profiles.
Signals that you are intentionally targeting EU customers include displaying EU prices, offering shipping to member states, running country-specific advertising, using local languages or domains, or accepting European payment methods. These signals can matter for consumer rules and help establish that GDPR's extraterritorial scope applies. A site that happens to be accessible from Europe is not necessarily the same as a company actively offering goods or services there.
For GDPR specifically, Article 3 has two branches: offering goods or services to people in the EU, or monitoring their behavior there. Monitoring covers behavioral advertising, analytics that build profiles, cookies and pixels, device fingerprinting, location tracking, and similar activity designed to analyze or predict what individuals do. The dividing line is conduct. A US business that occasionally receives an unsolicited order from Europe is in a different position from one whose growth team runs paid campaigns into Germany, France, or Spain, or whose app measures how EU users behave. The second company is not experiencing accidental exposure, and the absence of an EU entity is no defense. It is usually the fact that creates the representative requirement discussed below.
The legal controls behind selling into Europe legally
Privacy is an operating requirement, not a policy-page exercise
If you offer goods or services to people in the EU or monitor their behavior, GDPR may apply even when your company has no EU office. This commonly affects US SaaS platforms, apps, marketplaces, analytics businesses, ad-tech vendors, and online stores. Employee count and revenue do not provide a reliable exemption.
Begin with a real data map. Identify the data you collect, the purpose for each use, where it flows, which vendors receive it, how long it is retained, and whether it moves from the EU to the United States or elsewhere. That work supports nearly every other privacy decision: your privacy notice, legal bases for processing, vendor agreements, security controls, retention schedule, and response process for access or deletion requests.
Include the less obvious sources: sales leads, job applicants, trial users, support tickets, product telemetry, cookie data, and marketing audiences. A typical flow starts with website analytics or a lead form, moves into a CRM, continues through product accounts and support tickets, and ends in cloud hosting, payment processing, or marketing platforms. Your privacy, security, product, and legal owners should be able to answer basic questions without guessing. Which EU residents do we serve? Are we a controller, a processor, or both? Which vendors process data on our behalf? Do we use data for advertising or profiling? Can we locate and export one person's data if asked?
Roles and lawful bases follow from the map. A business that decides why and how personal data is used is generally a controller; a vendor processing data only on a customer's instructions is generally a processor, and many SaaS companies are both, depending on the data flow. For each controller activity, choose a lawful basis and record why it fits. Consent may suit optional tracking or some marketing, but it is not the default answer: contract necessity, legitimate interests, or legal obligation may fit other purposes better.
A privacy notice should describe the actual processing, not repeat a generic template. It should identify the controller, purposes, legal bases, retention periods, recipients, international transfers, individual rights, and, where one is required, your EU representative. If cookies support analytics, advertising, or cross-site tracking, assess whether prior consent is required before they run. If your banner says one thing and your tag manager does another, the problem is bigger than wording.
Article 27: an accountable contact, not an address
For many non-EU businesses, GDPR Article 27 is the visible missing piece. A company subject to GDPR that lacks an EU establishment generally must appoint an EU representative, unless a narrow exception applies. The exception is not a safe assumption for companies that process data regularly, use tracking technology, operate at scale, or create meaningful risks for individuals.
The exception covers processing that is occasional, does not include large-scale processing of special-category or criminal-offense data, and is unlikely to result in a risk to individuals' rights and freedoms. The conditions are cumulative. Recurring SaaS subscriptions, ongoing customer accounts, ecommerce operations, product analytics, and structured marketing are rarely "occasional" in any reasonable sense, so treat the question as a documented assessment, not a self-certification. It is also one of the easiest gaps to spot from outside: procurement teams ask for representative details, and a privacy notice that references the EU but names no representative shows the omission to anyone who reads it.
The appointment is made in writing, typically through a signed designation, and the representative must be established in a member state where affected individuals are located. The representative's details must be available to data subjects and supervisory authorities. More importantly, this representative must be able to receive and coordinate communications about your GDPR obligations, and your internal teams should know how a matter moves from the representative to the people who can investigate and approve a response.
An anonymous forwarding provider with no accountable entity behind it, and no process for logging and escalating what arrives, may create a dangerous delay when a complaint, deadline, or incident requires a response. rep4eu provides EU representative coverage through Cloudkasten GmbH, a registered German GmbH with German-admitted lawyers on the team, for companies that need a designated point of contact that is accountable and reachable, not just an address in a privacy notice. Cloudkasten GmbH holds and signs the designation, forwards and logs inquiries from authorities and data subjects, and coordinates with authorities. Legal advice and drafting your responses are not part of the subscription, so your company or its counsel still owns the substance of every answer.
Consumer sales require local-facing terms and practices
If you sell to EU consumers, the consumer contract deserves as much attention as the checkout design. European consumer rules often require clear pre-contract information about the seller, price, taxes, delivery costs, product characteristics, payment, and complaint processes. The information must be understandable and available before the customer is bound.
Distance sales commonly carry a 14-day withdrawal right, subject to defined exceptions. Digital content, customized goods, services that have begun with consent, and certain sealed products can be treated differently, but the exception must be handled correctly. A vague statement that all sales are final is not a substitute for compliant cancellation and refund terms.
Do not hide the identity of the contracting entity, applicable taxes, or recurring subscription terms. Dark-pattern practices, such as making cancellation unnecessarily difficult or presenting an artificially urgent countdown, are particularly poor choices in a market where consumer authorities are increasingly focused on online design. If you sell subscriptions, make renewal timing, price, and cancellation mechanics conspicuous.
B2B sales can be more flexible, but do not label every buyer a business and assume consumer rules disappear. The relevant facts include who buys, for what purpose, and how your sales flow operates.
Tax, customs, and product compliance can stop the sale
Physical goods create a separate layer of responsibility. VAT can arise based on where goods are located, where they are imported, sales volume, and whether you sell through a marketplace. The Import One-Stop Shop can simplify certain low-value imports, but it is not a universal solution. A shipment that reaches a customer with surprise duties and taxes is both a compliance issue and a fast route to chargebacks.
Products may also require safety assessments, technical documentation, labeling, traceability, instructions, and in some categories, CE marking. Electronics, toys, cosmetics, medical devices, machinery, and products with batteries or packaging obligations require particular care. In many cases, an EU-based economic operator or responsible person is required. A US company cannot self-certify its way around requirements that depend on testing, declarations, registration, or local representation.
For digital services, tax rules still matter. VAT treatment can depend on whether the customer is a consumer or business and on the customer's location. Build a process for collecting the information needed to make that distinction, applying the appropriate rate, and retaining records. Your payment processor may help, but it does not automatically take responsibility for your full VAT position.
Run GDPR as a process, not a set of documents
A privacy policy is only the visible edge of compliance; the internal practices behind it decide whether the policy is true. A policy promising deletion is a liability if no one can locate the data. Scale changes what is expected: a five-person SaaS startup selling into two member states is not held to the same infrastructure as a platform profiling users at scale, but both need documented decisions and named owners.
Records, contracts, and security
The core package for most US companies in scope looks like this:
- A record of processing activities, where required, documenting data flows and internal ownership.
- Data processing agreements with every vendor that processes personal data on your behalf, covering GDPR's required processor terms, and processor terms for your own customers where you act as their processor.
- A retention schedule that turns "we keep data only as long as necessary" into actual deletion or review rules.
- Security measures appropriate to the risk, including access management, encryption where appropriate, vendor review, logging, backups, and tested incident procedures.
- Written procedures, with named owners, for rights requests, regulator contact, and incident escalation.
GDPR does not prescribe one universal control set: what is appropriate depends on data volume, sensitivity, your systems and vendors, and the likely harm if something goes wrong.
Transfers to the United States
EU personal data moving to the United States is a transfer issue even when everything else is in order. Each transfer needs a lawful mechanism: depending on the circumstances, an adequacy-based framework, Standard Contractual Clauses, or another permitted route, plus any supplementary measures the circumstances require. Your cloud provider, CRM, support platform, analytics tools, payroll vendor, and their subprocessors may all sit in the transfer chain, so review their contractual terms, security measures, locations, and onward-transfer practices.
Standard Contractual Clauses are not a document that cures every transfer, and the mechanism has to match the real data flow. If your records say data stays in the EU while US administrators routinely access it, your records do not reflect reality. This is also where companies tend to overstate compliance in sales conversations and under-document it internally, and enterprise buyers increasingly ask before signing, especially when the vendor handles customer, employee, health, financial, or behavioral data.
Data subject requests
EU individuals can ask to access, correct, delete, restrict, or port their data, or object to processing, depending on the circumstances. In many cases you must respond within one month. A request can arrive through support, a generic inbox, a social channel, a former employee's mailbox, or your EU representative, and the clock does not pause while it sits there. If you need more time because a request is complex or one of many, make that decision early and tell the individual.
A workable process needs at least these controls:
- A designated owner for privacy requests, with a backup decision-maker.
- Identity verification that does not collect excessive additional data.
- Written instructions so support, product, engineering, and marketing teams recognize a request and pass it on.
- A way to locate the relevant data across internal tools and service providers.
- An escalation path for high-risk requests, complaints, and regulator correspondence, and a record of every outcome.
Not every request must be granted in full. Some data may have to be kept for legal claims, fraud prevention, accounting, or another person's rights. That is not a reason to reject the whole request with a generic reply: separate what must be retained from what should be deleted, and explain the result. The data subject request guide walks through each step.
Breach notification
Where a personal data breach is likely to result in a risk to individuals' rights and freedoms, the controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Finding the rule is easy. The hard part is establishing under pressure what happened, which data was affected, whether EU residents are involved, and who has authority to make the reporting decision.
Run a tabletop exercise before you need one. Ask who makes the notification decision, who informs your EU representative, who contacts customers, and where evidence is preserved. Engineering needs to know how to escalate suspicious activity. A response plan that has never been tested is often just a folder of reassuring language.
Build a launch process that can withstand scrutiny
The lowest-risk approach is to treat Europe as a controlled market launch, not a geographic toggle in your checkout. Give one owner responsibility for coordinating legal, privacy, product, finance, security, and customer support decisions. The business does not need to solve every theoretical issue on day one, but it does need to resolve the obligations tied to its actual model before it solicits customers.
A practical launch review should answer four questions. First, which countries are you targeting and are the buyers consumers, businesses, or both? Second, what personal data, cookies, and behavioral data are involved? Third, does the product require EU-facing safety, labeling, customs, VAT, or responsible-person arrangements? Fourth, who can respond quickly if an individual, customer procurement team, or supervisory authority contacts the company?
Then document the answers. Keep current contracts with processors, records of processing activities where required, transfer assessments, security incident procedures, product documentation, and tax decisions. Documentation is not bureaucracy for its own sake. It lets your team answer a procurement questionnaire consistently, defend a decision later, and avoid rebuilding the facts during a deadline.
Avoid the shortcuts that create obvious exposure
The recurring mistake is treating compliance as a footer exercise. Adding a GDPR reference to a privacy policy while loading advertising cookies before consent does not solve the tracking issue, and a cookie banner does not fix an inaccurate notice, missing legal bases, absent vendor terms, or a broken rights process. Naming an EU representative without confirming the service can handle authority communications does not create operational coverage. Translating US consumer terms does not make them suitable for EU consumer law.
Another mistake is buying the cheapest available contact address because Article 27 appears administrative. It is administrative until the first regulator letter, data subject complaint, or breach notification requires a coordinated response. At that point, the quality of representation becomes part of your risk posture.
Scope also matters. A company with occasional, limited EU activity may have a narrower compliance program than a platform profiling millions of users across member states. But "we are small" is not a defensible strategy when your product design clearly targets EU residents and continuously processes their data. Low EU revenue does not mean low exposure, and the first pressure point is often a buyer: a SaaS company with a few hundred EU users can stall in procurement when a customer asks for its Article 27 details or a security questionnaire flags thin transfer documentation. Once one gap is visible, buyers and regulators tend to ask harder questions about the rest.
Europe can be a strong growth market when legal readiness is built into the launch rather than bolted on after the first complaint. Put credible people, documented decisions, and workable response paths in place before you ask EU customers to trust you with their money or their data.
Frequently asked questions
Does GDPR apply if our product is free?
It can. Payment is not part of the test, so a free app, SaaS trial, newsletter, or ad-supported service offered to people in the EU may be in scope, as may any service that monitors their behavior.
Does an EU representative take over responsibility for our GDPR compliance?
No. Your US company remains accountable for its processing decisions, security, vendor management, and responses. The representative is a contact point for authorities and data subjects, and it is a separate role from a data protection officer.
In which EU country does the representative need to be?
In one of the member states where the individuals whose data you process are located. Its name and contact details then go into your privacy notice.
What should we have ready before appointing a representative?
Know which entity is making the appointment, which products or services you offer into the EU, which categories of personal data are involved, and which vendors or subprocessors play a material role. Also name your internal owners for privacy, security, and incident response, so incoming matters reach someone who can act.