GDPR for US companies with EU users

Checked against the GDPR (Regulation (EU) 2016/679) as published in the Official Journal. The EU Publications Office records no amendment to it as of October 31, 2026.

The GDPR can apply to a US company with no EU office. Without an EU establishment, it applies when you process personal data of people in the EU and the processing relates to offering them goods or services, or to monitoring their behavior in the EU (Art. 3(2)). It has applied since May 25, 2018 (Art. 99(2)).

Your situation	What the GDPR says	Source
You have an EU establishment, such as a branch	Applies to processing in the context of its activities, wherever the processing happens	Art. 3(1)
No EU establishment; you offer goods or services, paid or free, to people in the EU	Applies to the processing related to that offer	Art. 3(2)(a)
No EU establishment; you monitor the behavior of people in the EU	Applies to the processing related to that monitoring	Art. 3(2)(b)
Your website can be reached from the EU, and nothing more	Not enough on its own	Recital 23
Art. 3(2) applies to you	Designate an EU representative, unless an exception applies	Art. 27

When the GDPR reaches a US company

Art. 3(2) covers controllers and processors. The test is whether people are in the EU; the text does not mention citizenship or residence.

Targeting. Recital 23 asks whether it is apparent that you envisage offering services to people in one or more EU countries. A website that can be reached from the EU, an email address, or the use of a language generally used in the US is not enough on its own. Using an EU language or currency with the option to order in it, or mentioning customers or users in the EU, can show that intent.

Monitoring. Recital 24 points to tracking people on the internet, including profiling them to make decisions about them or to analyze or predict their preferences, behaviors and attitudes. An AI feature that profiles EU users from their activity is a case to check carefully.

Controller or processor

A controller decides the purposes and means of processing, alone or jointly with others (Art. 4(7)). A processor processes personal data on its behalf (Art. 4(8)), under a written contract covering the points in Art. 28(3), such as acting only on documented instructions. A processor that decides the purposes and means itself is treated as a controller for that processing (Art. 28(10)).

Lawful bases

Every processing operation needs at least one of six bases (Art. 6(1)): consent, contract, legal obligation, vital interests, public task, or legitimate interests. Legitimate interests only work where the processing is necessary for your or a third party’s interests and the person’s interests and rights do not override them, with particular weight where the person is a child.

Special categories of data (Art. 9(1)), such as health, biometric data used to identify someone, racial or ethnic origin, or sexual orientation, are prohibited unless an exception in Art. 9(2) applies, such as explicit consent. You still need an Art. 6 basis as well.

The EU representative (Art. 27)

Where Art. 3(2) applies, the controller or processor must designate in writing a representative established in an EU country where the people whose data it processes are (27(1), (3)). Authorities and individuals can address it on all processing issues (27(4)); it does not shield you from legal action (27(5)). Your privacy notice names it (Art. 13(1)(a)).

Public authorities are exempt, and so is processing that is occasional, excludes large-scale processing of special categories or criminal-offence data, and is unlikely to result in a risk to people’s rights (27(2)). Breaching Art. 27 can bring fines up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher (Art. 83(4)).

The EU AI Act has a separate representative duty for some non-EU providers: see authorized representative.

DPIA basics

The controller carries out a data protection impact assessment (DPIA) before processing that is likely to result in a high risk to people’s rights, in particular with new technologies (Art. 35(1)). It is required in particular for (35(3)):

• systematic and extensive evaluation of people based on automated processing, including profiling, that leads to decisions with legal or similarly significant effects;
• large-scale processing of special categories or criminal-offence data;
• large-scale systematic monitoring of publicly accessible areas.

EU supervisory authorities publish lists of processing that needs a DPIA (35(4)). The assessment describes the processing, tests necessity and proportionality, assesses the risks and sets out the measures (35(7)). Where it indicates a high risk in the absence of measures you take to mitigate it, consult the supervisory authority before you start (Art. 36(1)). Recitals 84 and 94 describe this as a high risk that you cannot reduce with appropriate measures.

International transfers

When a controller or processor subject to the GDPR sends personal data to a recipient outside the EU, the transfer needs a Chapter V route (Art. 44). In the European Data Protection Board’s reading, data that people in the EU give you directly is not a transfer, though the GDPR still applies to it; an EU business customer or vendor sending you personal data is (EDPB Guidelines 05/2021).

The main routes are an adequacy decision (Art. 45), appropriate safeguards such as the Commission’s standard data protection clauses or binding corporate rules (Arts. 46-47), and, where neither exists, derogations for specific situations, such as explicit consent (Art. 49). For the US, Commission Implementing Decision (EU) 2023/1795 of July 10, 2023 finds adequate protection only for transfers to organizations on the Data Privacy Framework List kept by the U.S. Department of Commerce (its Art. 1).

Where the GDPR and the AI Act meet

The AI Act leaves the GDPR in place: apart from Arts. 4a and 59 (some processing for bias detection and in regulatory sandboxes), it does not affect it (AI Act Art. 2(7)). Both apply side by side:

• Automated decisions. GDPR Art. 22 gives people a right not to be subject to solely automated decisions with legal or similarly significant effects, subject to its exceptions and safeguards. The AI Act adds a right to an explanation of the AI system’s role and the main elements of a decision a deployer takes on the basis of an Annex III high-risk system (other than critical infrastructure), where the decision has legal or similarly significant effects the person considers adverse, unless EU or national law provides otherwise or EU law already gives that right (Art. 86).
• DPIA and FRIA. Deployers of high-risk AI use the provider’s instructions for their DPIA (Art. 26(9)), and a fundamental rights impact assessment can cross-refer to it (Art. 27(4)).
• Bias testing. Art. 4a allows providers and deployers to process special categories of data where strictly necessary to detect and correct bias, under strict conditions, in addition to the GDPR’s own rules.
• Profiling. The AI Act uses the GDPR’s definition of profiling (Art. 3(52)), and an Annex III system that profiles people is always high-risk (Art. 6(3)).

More on the AI Act: The EU AI Act for US companies.

How Oblioria helps

Oblioria’s assessment covers the GDPR alongside the EU AI Act for each AI system: lawful basis, special categories, automated decisions, records, DPIAs, a data protection officer, processors and transfers. A consultant assigned to your company reviews your team’s answers and can ask follow-up questions. Your report then sets out, from your answers and after expert review, your likely role, the risk category and the obligations that apply, with their dates. It is general information, not legal advice, and Oblioria is not a law firm.

FAQ

Our website is open to everyone. Does that alone bring us under the GDPR? On its own, no. Recital 23 says mere accessibility from the EU is not enough. Offering goods or services to people in the EU, or monitoring their behavior there, is what counts.

Do we need an EU representative? Yes, if Art. 3(2) applies to you, unless your processing fits the narrow exception in Art. 27(2).

Who is the controller when an AI vendor processes our users’ data? Usually you are, and the vendor is your processor under an Art. 28 contract. If the vendor uses the data for its own purposes, it is a controller for that processing (Art. 28(10)).

Do sign-ups from EU users need standard contractual clauses? In the EDPB’s reading, data people give you directly is not a transfer, so Chapter V does not apply to it; the rest of the GDPR does. Data an EU business customer or vendor sends you is a transfer and needs a Chapter V route.

More on the GDPR

• GDPR basics for US companies with EU users: what to set up first once the GDPR applies.
• Does the EU AI Act apply to a US company?: how the AI Act’s scope differs from the GDPR’s.
• The EU AI Act for US companies: roles, risk tiers and dates.

Sources

• Regulation (EU) 2016/679 (GDPR), Official Journal: Arts. 3, 4, 6, 9, 13, 22, 27, 28, 35, 36, 44 to 49, 83 and 99; Recitals 23, 24, 84 and 94
• European Data Protection Board, Guidelines 05/2021 on the interplay between Art. 3 and Chapter V, version 2.0
• Commission Implementing Decision (EU) 2023/1795, Official Journal
• U.S. Department of Commerce, Data Privacy Framework List
• AI Act Service Desk: Art. 2, Art. 3, Art. 4a, Art. 6, Art. 26, Art. 27, Art. 86

This page is general information, not legal advice.