{"head":{"title":"Does GDPR Apply to US Companies? Article 3 Explained","description":"GDPR applies to a US company that offers goods or services to people in the EU or monitors their behaviour there. How Article 3 works and what follows.","canonical":"https://oceanlab.in/questions/does-gdpr-apply-to-us-companies"},"crumbs":[{"name":"Home","path":"/"},{"name":"Questions","path":"/questions"},{"name":"Does GDPR apply to US companies?","path":"/questions/does-gdpr-apply-to-us-companies"}],"question":"Does GDPR apply to US companies?","answer":["Yes, in two cases: when a US company offers goods or services to people who are in the EU, paid or free, or when it monitors their behaviour in the EU, such as tracking or profiling. It also applies to any processing done in the context of an EU office or branch."],"sections":[{"heading":"The two triggers in Article 3(2)","body":[["Article 3(2) of the GDPR covers controllers and processors not established in the EU when their processing relates to (a) offering goods or services to data subjects in the EU, whether or not payment is required, or (b) monitoring their behaviour as far as it takes place in the EU."],["What matters is whether you target people who are in the EU, not their citizenship. Signals of targeting include EU languages or currencies, shipping to EU countries, EU marketing and EU-specific pages. A site that EU visitors can merely reach is not enough on its own, but tracking and profiling those visitors can be."]],"bullets":[]},{"heading":"If it applies, what changes","body":[],"bullets":[["A lawful basis for each processing purpose, and a privacy notice that says so."],["Rights handling: access, correction, deletion, portability and objection, within the legal deadlines."],["Processor contracts (data processing agreements) with vendors that handle the data for you."],["Rules for transfers of personal data out of the EU, which affect US hosting and US sub-processors."],["An EU representative under Article 27, unless your processing is occasional, low risk and not large-scale special-category data."],["Security, breach notification and, for risky processing, a data protection impact assessment."]]},{"heading":"What it means for the build","body":[["Design for it from the start: consent and cookie handling that actually blocks trackers until consent, a way to find and export or delete one person's data across every table and vendor, retention rules, and region-aware hosting where needed."]],"bullets":[]}],"faqs":[{"question":"We are B2B only. Does GDPR still apply?","answer":"It can. Business contacts are people, so names, work emails and usage data of users at EU customers are personal data. You are often a processor for your customer's data and a controller for your own sales and account data."},{"question":"Does the CCPA cover the same ground?","answer":"No. US state privacy laws have their own scope and duties. Meeting GDPR helps, but check each law separately."},{"question":"Do we need an EU representative?","answer":"Under Article 27, yes when Article 3(2) applies, unless your processing is occasional, unlikely to be risky and does not include large-scale special-category or criminal data, or you are a public body."}],"terms":[{"href":"/glossary/phi","label":"PHI"},{"href":"/glossary/high-risk-ai-system","label":"high-risk AI system"},{"href":"/glossary/soc-2-type-ii","label":"SOC 2 Type II"}],"tools":[],"links":[{"href":"/compliance/gdpr","label":"GDPR guide","detail":"Who the GDPR applies to and what it asks of software."},{"href":"/glossary/dpa","label":"DPA (data processing agreement)","detail":"Glossary"},{"href":"/glossary/data-processor","label":"Data processor","detail":"Glossary"},{"href":"/compliance","label":"Compliance guides","detail":"What each rule means for the software you build."}],"related":[{"href":"/questions/does-the-european-accessibility-act-apply-to-me","label":"Does the European Accessibility Act apply to me?","detail":"Question"},{"href":"/questions/when-do-eu-ai-act-rules-apply","label":"When do the EU AI Act rules apply?","detail":"Question"},{"href":"/questions/do-i-need-soc-2","label":"Do I need SOC 2?","detail":"Question"},{"href":"/compare/ai-agent-vs-workflow-automation","label":"AI agent vs workflow automation","detail":"Comparison"},{"href":"/compare/rag-vs-fine-tuning","label":"RAG vs fine-tuning","detail":"Comparison"},{"href":"/glossary","label":"Glossary","detail":"Every term, in plain words."}],"sources":[{"title":"Regulation (EU) 2016/679, the GDPR (Official Journal)","url":"https://data.europa.eu/eli/reg/2016/679/oj","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}