Who Does GDPR Apply To? Key Criteria for Compliance

Meta description: Find out who the GDPR applies to, including U.S. businesses, and learn how EU establishment, customers, behavioral tracking, and data-processing roles affect compliance.

The General Data Protection Regulation (GDPR) can apply to organizations far beyond the European Union. A U.S. company may have GDPR responsibilities if it operates through an establishment in the EU, offers goods or services to people there, or monitors their behavior in the region. The main test is not where a company is incorporated or where its servers sit. It is whether the organization’s activities meet the regulation’s territorial and personal-data criteria.

What the GDPR Covers

The GDPR is the EU’s main data protection law. It governs the processing of personal data by organizations acting as controllers or processors. “Processing” is broad: it includes collecting, recording, organizing, storing, using, disclosing, and deleting information.

Personal data is information that relates to an identified or identifiable natural person. It can include a name, email address, location data, online identifier, customer account details, or information that identifies someone when combined with other data. Pseudonymized data generally remains personal data if it can be linked back to a person using additional information.

Data that has been irreversibly anonymized so no person is identifiable is generally outside the GDPR’s personal-data rules. Simply removing names is not necessarily enough: if a person can still be singled out or reidentified, the information may remain personal data.

Who Does GDPR Apply To?

Article 3 of the GDPR sets out the principal territorial-scope tests. It applies to organizations established in the EU in certain circumstances, and it can also apply to organizations outside the EU when they offer goods or services to people in the EU or monitor their behavior there.

The regulation applies to both controllers and processors. A controller determines why and how personal data is processed. A processor handles personal data on a controller’s behalf, such as a cloud hosting provider or a payroll service. A company’s role depends on what it actually does, not only on the label in a contract.

1. Organizations With an EU Establishment

The GDPR applies to processing carried out in the context of the activities of an organization’s establishment in the EU, even if the data processing itself takes place elsewhere. This can cover a U.S.-headquartered company with an EU office, branch, or other stable arrangement that effectively carries out real and effective activity.

An establishment does not necessarily require a subsidiary or a large physical office. The facts matter, including the stability of the arrangement and the nature of the organization’s activities. A European office that supports sales or customer relationships may be relevant when assessing whether processing is connected to the organization’s EU activities.

This test does not automatically make every activity of a global company subject to the GDPR. The processing must occur in the context of the EU establishment’s activities. Because that connection is fact-specific, organizations operating across borders should assess each business activity rather than relying on the location of their headquarters alone.

2. Organizations Offering Goods or Services in the EU

A company outside the EU may be covered when it offers goods or services to people who are in the EU. The service does not have to be paid for, and the organization does not need a physical presence there. The key is whether the company’s conduct shows an intention to serve people in the EU, rather than merely making a website accessible from the region.

Relevant signals can include:

• Advertising or marketing specifically directed at EU countries or audiences.
• Offering an EU language or local currency as part of a targeted customer experience.
• Providing EU-specific delivery, pricing, or customer support.
• Using EU-based testimonials or describing customers in EU countries.
• Allowing customers to select an EU country when ordering goods or registering for a service.

No single signal necessarily decides the question. For example, an English-language website that can be viewed in Europe does not, by itself, prove that a U.S. company intends to offer services there. The overall context, including marketing, sales, and customer onboarding, is more informative.

3. Organizations Monitoring Behavior in the EU

The GDPR can also apply when an organization outside the EU monitors the behavior of people who are in the EU, where that behavior takes place there. Online monitoring may include tracking people across websites or services to analyze or predict their preferences, interests, behavior, or movements.

Examples may include behavioral advertising, profiling based on browsing activity, persistent tracking through cookies or device identifiers, and location-based analytics. The test focuses on the nature and purpose of the monitoring, not simply whether a website collects basic technical information. Organizations should examine what data is gathered, how it is combined, and whether it is used to observe or predict individual behavior.

For this test, a person’s location at the time of the relevant activity is important. EU citizenship is not required. A U.S. citizen visiting France may be in the EU, while an EU citizen living in the United States is not necessarily in the EU for a particular service interaction.

Does GDPR Apply to U.S. Companies?

Yes, when a U.S. company meets one of the GDPR’s territorial-scope tests. A U.S. business could be covered because it has an EU establishment, deliberately sells or provides services to people in EU countries, or monitors people’s behavior there. The location of its headquarters, employees, databases, and servers does not by itself settle the question.

For example, a U.S. online retailer that targets shoppers in Germany and delivers orders there may fall within the offering-goods test. A U.S. analytics company that tracks EU users to build behavioral profiles may fall within the monitoring test. By contrast, a U.S. website that is merely accessible from Europe, with no EU-focused offering or behavioral monitoring, is not automatically covered under those tests.

Companies should also distinguish GDPR coverage from international data-transfer rules. If the GDPR applies and personal data is sent from the European Economic Area to a country without an applicable adequacy decision, additional transfer safeguards may be required. Standard Contractual Clauses and transfer assessments are common tools, but their suitability depends on the circumstances.

Who Is Not Automatically Covered?

Not every organization that handles information about someone in Europe is subject to the GDPR. A business is not automatically covered just because an EU resident visits its website, buys a product while outside the EU, or appears in a database. The relevant territorial-scope criteria and the circumstances of the processing still matter.

The GDPR also has defined boundaries and exceptions. For example, it does not apply to processing by a natural person in the course of a purely personal or household activity. It excludes certain activities involving national security and law enforcement, which may be governed by other laws. These exceptions are narrow and should not be assumed to cover ordinary business activity.

Data that is genuinely anonymous is generally outside the GDPR because it no longer relates to an identifiable person. However, pseudonymized or encrypted data can still be personal data when identification remains possible, including through information held separately.

How Controllers and Processors Share Responsibilities

Controllers decide the purposes and essential means of processing. They generally have direct responsibilities for matters such as identifying a lawful basis, providing privacy information, responding to individual rights requests, and demonstrating compliance. A controller may be a business, nonprofit, public body, or other organization.

Processors handle data on behalf of a controller and must follow documented instructions and the GDPR’s processor requirements. A written data-processing agreement is generally required under Article 28. It should address matters such as confidentiality, security, subprocessors, assistance with rights requests, breach support, and deletion or return of data when services end.

Some organizations may be joint controllers when they jointly determine the purposes and means of particular processing. Their arrangement should transparently allocate responsibilities, especially for providing privacy information and handling rights requests. Contracts can document the arrangement, but actual decision-making remains important.

Key Compliance Duties When GDPR Applies

Being within the GDPR’s scope is only the first step. Covered organizations need to assess the processing they conduct and apply the regulation’s principles and requirements. Core duties commonly include:

• Choose and document a lawful basis. Each processing purpose needs an applicable basis, such as consent, contract necessity, legal obligation, vital interests, public task, or legitimate interests. Consent is not the default basis for every activity.
• Provide clear privacy information. Notices should explain relevant details, including purposes, legal bases, data categories, recipients, retention periods, rights, and applicable international transfers.
• Respect individual rights. Depending on the circumstances, people may have rights to access, correct, erase, restrict, or object to processing, as well as data portability. Requests generally require a response within one month, subject to permitted extensions and other rules.
• Limit data and retention. Collect only what is needed for stated purposes, keep it accurate, and retain it no longer than necessary under a defensible schedule.
• Protect personal data. Use technical and organizational security measures appropriate to the risks. These may include access controls, encryption, staff training, backup procedures, and incident response plans.
• Assess higher-risk processing. A data protection impact assessment may be required before processing likely to create a high risk to people’s rights and freedoms.
• Manage breaches. A controller may need to notify its supervisory authority within 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to create a risk to individuals. Affected people must be notified in certain high-risk cases.

Some controllers and processors must appoint a data protection officer, particularly where core activities involve large-scale regular and systematic monitoring or large-scale processing of special-category or criminal-offense data. Organizations outside the EU that are subject to the regulation may also need to appoint an EU representative under Article 27, unless a limited exception applies.

EU Representative and Data Protection Officer

An EU representative is not the same as a data protection officer. A representative serves as a contact point for supervisory authorities and individuals for certain non-EU organizations covered by Article 3(2). The requirement generally applies unless the processing is occasional, does not include large-scale processing of specified sensitive data, and is unlikely to risk people’s rights and freedoms, or the organization is a qualifying public authority or body.

A data protection officer (DPO), when required, advises and monitors an organization’s data protection compliance and acts as a contact point. The DPO requirement depends on the organization’s activities, not simply on being a U.S. company or processing any personal data. A company may appoint a DPO voluntarily, but it should ensure the role can operate with appropriate independence.

A Practical GDPR Scope Assessment

Organizations can begin with a documented review of their operations. The assessment should identify where the organization and its relevant establishments operate, where people are located when services are offered or behavior is monitored, and which teams decide how personal data is used.

1. Map processing. Inventory personal data, purposes, systems, recipients, retention, and international data flows.
2. Check the territorial tests. Assess EU establishment links, EU-directed offers, and monitoring of behavior in the EU.
3. Identify roles. Determine whether the organization acts as controller, processor, or joint controller for each activity.
4. Review safeguards and records. Check privacy notices, lawful bases, contracts, security controls, rights procedures, and any required assessments or representative arrangements.
5. Reassess when operations change. New EU marketing, tracking tools, acquisitions, or service features can change the scope analysis.

GDPR scope is determined by the organization’s activities and the processing involved, not by a simple checklist of company size or server location. For U.S. organizations with EU customers, users, or operations, a careful, activity-by-activity assessment is a practical starting point. The European Data Protection Board’s territorial-scope guidance and the GDPR’s Articles 2, 3, 4, 27, and 28 provide useful reference points; complex cases may require advice from qualified privacy counsel.

Authoritative GDPR Resources

• Official GDPR text on EUR-Lex, including the territorial-scope rules in Article 3.
• European Data Protection Board Guidelines 3/2018 on the territorial scope of the GDPR.
• European Commission data protection information on EU data protection policy and rights.