EU representative for US companies.
All 27 states.

Who in the US is in scope of GDPR Article 27

A company established only in the United States falls under the EU GDPR through Article 3(2) when its processing relates to one of two activities:

• Offering goods or services to people in the EU, whether or not they pay. Recital 23 asks whether you envisage offering goods or services to people in one or more member states. It names two signals: using a language or currency of a member state with the possibility of ordering in that language, and mentioning customers or users in the EU. A website or email address that people in Europe can reach is not enough on its own. The EDPB’s Guidelines 3/2018 on territorial scope add further factors, such as offering delivery of goods to EU member states and marketing campaigns aimed at an EU audience.
• Monitoring the behaviour of people in the EU, as far as that behaviour takes place in the Union. Recital 24 refers to tracking people on the internet, including profiling to analyse or predict their preferences. The EDPB’s guidelines give behavioural advertising, geo-localisation for marketing purposes and online tracking through cookies or similar techniques as examples; whether analytics counts as monitoring depends on its purpose, in particular any later profiling.

What counts is where the individuals are when the goods or services are offered to them or their behaviour is monitored, not their citizenship. A US company in scope must designate, in writing, a representative established in the EU under Article 27(1), and, where it is the controller, name it in its privacy notice under Articles 13(1)(a) and 14(1)(a).

A US group with an EU subsidiary should check which entity runs the processing. Processing in the context of an EU establishment falls under Article 3(1). Processing that the US entity carries out itself and that targets or monitors people in the EU can still fall under Article 3(2) and require a representative for the US entity.

For a private company, the exemption in Article 27(2)(a) covers only processing that is occasional, does not include large-scale processing of special-category or criminal-offence data, and is unlikely to result in a risk to people’s rights and freedoms. Article 27(2)(b) separately exempts public authorities and bodies. A business that serves EU users as a regular part of its model rarely meets it.

Typical US companies that need an EU representative

• A Delaware-incorporated SaaS company that sells self-serve subscriptions to individuals in Germany, France and Spain, priced in euros, and handles their account and billing data itself.
• A Shopify store in Texas that ships to EU countries and shows prices in euros.
• A mobile app developer in California whose apps are offered to users in EU countries in their own languages and use advertising identifiers for behavioural advertising.
• An AI company offering a chatbot app directly to people in the EU.

Selling only to businesses does not by itself take a company outside the GDPR: the contacts and users at those businesses are individuals whose data the GDPR protects. Neither the GDPR nor the EDPB expressly settles whether a B2B offer counts as offering services to people in the EU under Article 3(2)(a), so the cautious approach is to treat it as in scope; monitoring of EU users under Article 3(2)(b) applies regardless. Where you are the controller, the representative’s name and contact details must appear in your privacy notice under Articles 13(1)(a) and 14(1)(a), so EU customers can see them.

US privacy law, the Data Privacy Framework and the EU GDPR

US privacy rules and the EU GDPR apply in parallel; meeting one set does not satisfy the other.

• State privacy laws such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act, protect residents of their own state; the CCPA gives rights only to California residents. The CCPA contains no duty to appoint an EU representative. Whether a US company needs one depends on Article 3(2) and Article 27 of the GDPR, not on its compliance with state law.
• The EU-U.S. Data Privacy Framework is the basis of the European Commission’s July 2023 adequacy decision. It allows personal data to be transferred from the EU to US organisations that have certified under the framework. It governs transfers only: a certified company that targets or monitors people in the EU still needs an EU representative under Article 27.
• A privacy officer or data protection officer in the US does not fill the role either. Article 27(3) requires the representative to be established in an EU member state where the affected individuals are, and the role is different from that of a DPO.