GDPR basics for US companies with EU users

Last verified October 31, 2026, against the GDPR (Regulation (EU) 2016/679) as published in the Official Journal.

Once the GDPR applies to your US company, set up the basics: a record of your processing, a lawful basis for each purpose, privacy notices, a rights-request process, processor contracts, security and a breach plan, an EU representative unless exempt, a check for DPIAs and a data protection officer, and a route for any data transfers.

Step	What to set up	Key rule	Article
1	Record of processing	What you hold, why, who receives it, how long you keep it	Art. 30
2	Lawful basis	One of six bases per purpose, chosen before you start	Art. 6
3	Privacy notice	At collection; for data from others, within a month at the latest, or sooner	Arts. 13-14
4	Rights requests	Answer within one month, extendable by two months	Art. 12(3)
5	Processor contracts	A written contract with the Art. 28(3) terms	Art. 28
6	Security and breaches	Notify the authority within 72 hours where feasible, unless the breach is unlikely to result in a risk	Arts. 32-34
7	EU representative	Designate one in writing, unless exempt	Art. 27
8	DPIA and DPO	A DPIA before likely high-risk processing; a DPO in the Art. 37(1) cases or where law requires one	Arts. 35, 37
9	Transfers	A Chapter V route when personal data is sent outside the EU	Arts. 44-49

Whether the GDPR applies at all (Art. 3(2)) is covered in GDPR for US companies with EU users. This article covers what comes next.

Start from the principles

Everything in the GDPR traces back to Art. 5. Personal data must be processed lawfully, fairly and transparently; collected for specified purposes and not reused in incompatible ways; limited to what is necessary; accurate; kept no longer than needed; and kept secure. The controller must be able to show that it complies (Art. 5(2)).

1. Know what you process

Map the personal data you hold: whose it is, what it is, why you use it, who receives it, where it goes and how long you keep it. Art. 30 turns this into a record of processing activities. Controllers record, among other things, the purposes, the categories of people and data, the recipients, transfers outside the EU and, where possible, retention periods and a description of security measures (30(1)). Processors keep a shorter record of what they do for each controller (30(2)).

Companies with fewer than 250 employees are exempt only if their processing is unlikely to result in a risk, is occasional, and does not include special categories or criminal-offence data (30(5)). A product that processes user data every day is hard to call occasional.

2. Pick a lawful basis for each purpose

Each purpose needs at least one basis from Art. 6(1): consent, contract, legal obligation, vital interests, public task or legitimate interests. Choose per purpose, before you start, because the basis shapes the rest: what you tell people, and which rights apply, such as portability for automated processing based on consent or contract (Art. 20), and objection where you rely on legitimate interests or public task, and always for direct marketing (Art. 21).

If you rely on consent, you must be able to show it, ask for it separately from other terms, and let people withdraw it as easily as they gave it. Making a service conditional on consent to data the service does not need weighs against consent being freely given (Art. 7). For online services offered directly to children, consent works only from age 16, unless an EU country sets a lower age, no lower than 13; below that age, a parent must give or authorize it (Art. 8).

Special categories, such as health data, biometric data used to identify someone, or data revealing racial or ethnic origin, are prohibited unless an Art. 9(2) exception applies, such as explicit consent.

3. Tell people

When you collect data from people, tell them at that moment (Art. 13): who you are and how to reach you and your EU representative; your purposes and lawful basis; your legitimate interests, if you rely on them; recipients; transfers outside the EU; retention; their rights, including withdrawing consent and complaining to a supervisory authority; and whether you use automated decision-making, including profiling, under Art. 22, with meaningful information about the logic involved and its likely consequences (13(2)(f)).

If you get data from someone else, such as a data broker or a customer, similar information, plus the categories of data and their source, is due within a reasonable period and at the latest within one month, or earlier if you first contact the person or disclose the data before then (Art. 14(3)), subject to the exceptions in Art. 14(5).

4. Be ready for rights requests

People can ask to access, correct or erase their data, restrict or object to its processing, and receive it in a portable format (Arts. 15 to 21), and they have rights around solely automated decisions (Art. 22). You must answer without undue delay and within one month. You can extend by two more months for complex or numerous requests, if you tell the person within the first month and say why (Art. 12(3)). Decide now who receives requests and how you verify identity.

5. Put contracts in place with vendors

If a vendor processes personal data for you, it is your processor. You may use only processors that give sufficient guarantees, and you need a written contract that covers the points in Art. 28(3): acting only on your documented instructions, confidentiality, security, rules for sub-processors, help with rights requests and with your security, breach notification, DPIA and prior-consultation duties, deletion or return at the end, and information for audits.

If you are the vendor, expect EU customers to send you this contract. A processor that starts deciding the purposes and means of processing itself is treated as a controller for that processing (Art. 28(10)). AI vendors that want to reuse customer data, for example to improve their models, should look at this closely.

6. Secure the data and plan for breaches

Controllers and processors must apply security measures suited to the risk (Art. 32). If a breach happens, the controller notifies the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk (Art. 33(1)). A processor tells the controller without undue delay (33(2)). If the breach is likely to result in a high risk, the controller also tells the people affected (Art. 34(1)). Record every breach, notified or not (33(5)). Write the plan before you need it.

7. Appoint an EU representative

Where Art. 3(2) applies, you must designate in writing a representative in an EU country where the people whose data you process are, unless your processing is occasional, excludes large-scale special-category or criminal-offence data, and is unlikely to result in a risk (Art. 27). Name the representative in your privacy notice. This is separate from the EU AI Act’s authorized representative.

8. Check for DPIAs and a DPO

A data protection impact assessment is due before processing likely to result in a high risk, for example systematic and extensive profiling that leads to decisions with legal or similarly significant effects (Art. 35). A data protection officer is required where your core activities involve regular and systematic monitoring of people on a large scale, or large-scale processing of special categories or criminal-offence data, or you are a public body (Art. 37(1)); EU or national law can require one in other cases (37(4)).

9. Look at transfers

Data sent to you or your vendors outside the EU by an EU business customer or processor needs a Chapter V route, such as an adequacy decision or standard data protection clauses (Arts. 44 to 49). In the European Data Protection Board’s reading, data that people in the EU give you directly is not a transfer, though the GDPR still applies to it (EDPB Guidelines 05/2021). The regulation page has the details.

Where AI adds work

AI products tend to touch the hardest parts of the GDPR. If you reuse customer or user data to train a model and did not specify that purpose when you collected it, check the new use against the purpose limitation principle (Art. 5(1)(b)) and the compatibility test in Art. 6(4), and tell people before the new use starts (Arts. 13(3), 14(4)). Scoring or ranking people can be profiling (Art. 4(4)), which brings Art. 22 and the DPIA list into play. If you also fall under the EU AI Act, see The EU AI Act for US companies and Provider or deployer: your EU AI Act role.

Fines

Fines reach EUR 20 million or 4% of worldwide annual turnover, whichever is higher, for breaches of the principles, lawful bases, consent, special categories, individual rights and transfer rules (Art. 83(5)). Most of the operational duties above, including records, processors, security, breach notice, DPIAs, DPOs and the representative, carry up to EUR 10 million or 2% (Art. 83(4)).

GDPR for US companies with EU users
Does the EU AI Act apply to a US company?: how the AI Act’s scope differs from the GDPR’s.
Provider or deployer: your EU AI Act role

Sources

Regulation (EU) 2016/679 (GDPR), Official Journal: Arts. 3 to 9, 12 to 14, 15 to 22, 27, 28, 30, 32 to 35, 37, 44 to 49 and 83
European Data Protection Board, Guidelines 05/2021 on the interplay between Art. 3 and Chapter V, version 2.0

This page is general information, not legal advice.