GDPR Compliance for US Companies

· About GDPR Compliance for US Companies

Key Takeaways

  • US companies must comply with GDPR if they offer goods or services to people in the EU/EEA or monitor their behavior there, even without an EU establishment, because Article 3 has extraterritorial reach.[5][6]
  • The GDPR remains in force as adopted on 27 April 2016 and applied from 25 May 2018, with no full replacement or repeal in 2025–2026, although the European Commission has proposed targeted simplifications that are still proposals rather than enacted amendments.[1][2]
  • Controllers and processors can be fined up to €20 million or 4% of worldwide annual turnover, whichever is higher, and regulators can also order processing bans, data deletion, or transfers to stop.[1][3]
  • Security, transparency, and breach response are core duties: controllers must use appropriate technical and organizational measures, provide layered notices, and notify certain breaches to supervisory authorities within 72 hours.[1][4]
  • International transfers from the EU to the US require a valid transfer mechanism, such as the EU-U.S. Data Privacy Framework, Standard Contractual Clauses, or another Chapter V safeguard; transfer assessments remain mandatory where required.[4][7]
  • B2C and adtech-heavy US businesses are often the highest-risk targets for enforcement because behavioral profiling, cross-border tracking, and consent/notice failures are recurring sources of GDPR fines.[2][3]

What It Is

The General Data Protection Regulation (GDPR) is the EU’s main data protection law, governing the processing of personal data of individuals in the European Union and European Economic Area.[1] It is enforced by national supervisory authorities in each Member State, coordinated at EU level by the European Data Protection Board (EDPB).[1][4]

The GDPR was adopted on 27 April 2016 and entered into force on 24 May 2016; it has applied since 25 May 2018.[1][2] As of 6 September 2026, the GDPR remains the operative framework for private-sector compliance, including for US companies caught by Article 3, and there is no enacted 2025–2026 overhaul replacing it.[1][2]

In 2025–2026, the European Commission advanced a Digital Omnibus package proposing targeted GDPR refinements, including changes touching personal-data definitions, breach notification, and transparency mechanics, but these are still proposals and should not be treated as law unless and until adopted.[2][3]

Who Must Comply

GDPR applies to a controller or processor not established in the EU where the processing relates to offering goods or services to individuals in the EU/EEA or monitoring their behavior within the EU/EEA.[1][6] For US companies, this usually captures e-commerce, SaaS, app publishers, adtech, analytics, and customer-support operations that intentionally reach EU users.

There is no minimum revenue threshold for applicability; scope turns on activity, not size.[1] Small US firms can be fully covered if they target EU residents or track them.

The GDPR has limited exemptions for purely personal or household activity, law-enforcement processing outside the GDPR’s scope, and certain journalistic, academic, artistic, or literary uses where Member State law provides derogations.[1] Most commercial US businesses do not benefit from those exemptions.

If a US company has no EU establishment, it may still need to appoint an EU representative under Article 27 unless an exemption applies, but that appointment does not replace the company’s underlying GDPR obligations.[1] Data protection officers are required only in specified cases, such as large-scale monitoring or large-scale special-category processing.[1]

Core Requirements

  1. Lawful basis and purpose limits — Every personal-data processing activity needs a lawful basis, such as contract, legal obligation, legitimate interests, consent, vital interests, or public task; the data must be collected for specified, explicit purposes and not reused incompatibly.[1]
  1. Transparency and notices — Controllers must provide concise, intelligible privacy information at collection or shortly after, including identity, purposes, lawful basis, retention, transfers, rights, and complaint routes.[1]
  1. Data subject rights handling — US companies must support EU rights requests, including access, rectification, erasure, restriction, portability, objection, and protection from certain automated decisions, and must respond within one month unless a lawful extension applies.[1]
  1. Security and breach response — Controllers and processors must implement appropriate security measures, and personal-data breaches affecting EU data must be notified to the supervisory authority within 72 hours unless unlikely to result in risk to individuals.[1]
  1. Processor governance — Where a US company processes data for another organization, it needs a GDPR-compliant data processing agreement with mandatory terms on instructions, confidentiality, subprocessors, assistance, deletion/return, and audits.[1]
  1. Transfer controls — Transfers from the EEA to the US or other third countries need a valid transfer mechanism and, where required, a transfer impact assessment and supplementary safeguards.[4][7]
  1. Documentation and accountability — Controllers must maintain internal records of processing in many cases, run DPIAs for high-risk processing, and embed privacy by design and by default into systems and workflows.[1]

Deadlines and Penalties

| Milestone | Date | What applies | |---|---:|---| | GDPR adopted | 27 April 2016 | EU formally adopted the regulation.[1] | | GDPR in force | 24 May 2016 | Legal force began; preparatory obligations followed.[1] | | GDPR applies | 25 May 2018 | Core compliance duties became enforceable.[1] | | Breach notice deadline | Ongoing, 72 hours | Notify supervisory authority after becoming aware of a notifiable breach.[1] | | EU-U.S. Data Privacy Framework decision | 10 July 2023 | Provides one transfer mechanism for certified US recipients.[4] |

The maximum administrative fine under GDPR is €20 million or 4% of total worldwide annual turnover for the most serious infringements, and €10 million or 2% for lesser infringements, whichever is higher in each tier.[1] Regulators may also issue reprimands, temporary or definitive processing bans, and orders to bring processing into compliance, suspend transfers, or erase data.[1]

How to Comply

  1. Map data flows and roles — Identify whether the company is a controller, processor, or both, document EU-facing products, and track where EU personal data is collected, stored, accessed, and transferred.[1]
  1. Classify legal bases and notices — For each processing purpose, record the lawful basis, define the purpose, and ensure notices match actual practices rather than aspirational language.[1]
  1. Operationalize rights requests — Build intake, identity verification, search, legal-review, and response workflows for access, deletion, portability, and objection requests with one-month service-level targets.[1]
  1. Harden security controls — Use an information-security program aligned to ISO 27001 and NIST CSF 2.0 for access control, logging, encryption, vulnerability management, vendor oversight, and incident response.[1]
  1. Run DPIAs for high-risk use cases — Conduct data protection impact assessments for profiling, large-scale monitoring, sensitive data, and new products that create elevated privacy risk.[1]
  1. Manage processors and subprocessors — Put GDPR-compliant clauses in place, flow obligations down contractually, and verify subprocessor approval, audits, and deletion obligations.[1]
  1. Control transfers to the US — Use an approved transfer tool where available, document transfer assessments where necessary, and avoid informal ad hoc transfers without a legal mechanism.[4][7]
  1. Build an AI governance layer where relevant — If the company uses AI on EU personal data, map accountability, model governance, and documentation to ISO 42001 as an operating framework, while still meeting GDPR’s separate lawful-basis and transparency rules.[2][3]

Related Regulations

  • California Consumer Privacy Act / CPRA — This overlaps with GDPR for some US firms, but it is narrower in scope, uses different rights and notice rules, and does not substitute for EU compliance.
  • EU AI Act — If the same system uses personal data for AI, the AI Act adds product and governance obligations, while GDPR still governs the processing of personal data.
  • UK GDPR — UK rules are similar but separate; companies with UK users may need dual compliance because UK transfer and enforcement rules differ.
  • ePrivacy rules — Cookie, tracking, and electronic communications rules can apply alongside GDPR to marketing, analytics, and device access.
  • NIS2 — Security and incident-response duties may overlap for in-scope entities, but NIS2 does not replace GDPR’s breach-notification and privacy requirements.

FAQ

Does GDPR apply to companies outside the EU?

Yes, if the company offers goods or services to people in the EU/EEA or monitors their behavior there.[1][6] Physical presence in Europe is not required for Article 3 to apply.[1]

Do US companies need an EU representative?

Usually yes, if they are caught by GDPR’s extraterritorial rules and do not have an EU establishment, unless a narrow exemption applies.[1] The representative is an access point for regulators and data subjects, but the company remains directly responsible for compliance.[1]

What is the GDPR breach notification deadline?

The supervisory-authority notice deadline is 72 hours after the controller becomes aware of a notifiable personal-data breach, unless the breach is unlikely to result in risk to individuals.[1] If the breach creates a high risk, affected individuals must also be informed without undue delay.[1]

Can a US company transfer EU data to the United States?

Yes, but only with a valid Chapter V transfer mechanism and associated safeguards where required.[4][7] The EU-U.S. Data Privacy Framework is available for certified US organizations, while Standard Contractual Clauses remain widely used for other transfers.[4][7]

What are the biggest GDPR fine risks for US companies?

The most common risks are unlawful tracking, weak transparency notices, missing lawful basis, defective consent, and failure to honor data subject rights.[2][3] Security failures and breach handling also remain major enforcement drivers.[2][3]

Has GDPR changed in 2025 or 2026?

No enacted EU-wide replacement has taken effect as of 6 September 2026, but the European Commission has proposed targeted amendments in a Digital Omnibus process.[2][3] Those proposals should be treated as pending until formally adopted and published as binding law.[2][3]

Sources

Put it into practice

More compliance guides