Does GDPR Apply to US Companies? Extraterritorial Scope Explained

Article 3 Triggers for US Firms

• EU/EEA establishment processing in the context of that establishment (Art 3(1))
• Offering goods/services to individuals in the Union (Art 3(2)(a))
• Monitoring behaviour of individuals in the Union (Art 3(2)(b)) — analytics, ads, tracking, security profiling

Practical US Programme Add-ons

• EU representative (Art 27) when required
• Chapter V transfer tool for EU→US flows
• Same RoPA, DPA, DSAR, and breach clocks as EU peers

How CyberSilo Helps

• Scope mapping and evidence for US SaaS selling into the EU
• Transfer and vendor registers in CSA

Frequently Asked Questions

Does having no EU office avoid GDPR?

No. Article 3(2) can still apply based on offering or monitoring.

Do I need an EU representative?

Often yes under Article 27 if Art 3(2) applies and you have no Union establishment (subject to exceptions).

Is CCPA enough for EU customers?

No. CCPA/CPRA and GDPR differ in scope, lawful basis, and fine regimes.

Related GDPR Resources

GDPR hub · GDPR for SaaS · GDPR vs CCPA · CSA