{"id":11059,"date":"2026-02-10T10:35:09","date_gmt":"2026-02-10T09:35:09","guid":{"rendered":"https:\/\/s8.tgin.eu\/?p=11059"},"modified":"2026-02-10T10:35:11","modified_gmt":"2026-02-10T09:35:11","slug":"does-the-gdpr-apply-to-my-us-company","status":"publish","type":"post","link":"https:\/\/techgdpr.com\/blog\/does-the-gdpr-apply-to-my-us-company\/","title":{"rendered":"Does the GDPR apply to my US company?"},"content":{"rendered":"\n

Introduction<\/h2>\n\n\n\n

The usual assumption of most US businesses is, “the GDPR is an EU regulation, hence it does not impact my organisation.” This belief results most often in unnecessary risk. The US equivalent of this misconception would be a company registered in Texas thinking its services don\u2019t fall under the scope of the CCPA. <\/p>\n\n\n\n

The GDPR has extraterritorial effect, that is, it has effect on and more often than not, does affect organisations which are outside the European Union.<\/p>\n\n\n\n

Note that since Brexit, the UK has maintained GDPR provisions but further adapted them to its body of laws, this is known as the UK GDPR which adds an additional but small level of complexity for transfers of data outside the UK. For the sake of simplicity, the term GDPR used in this article will also apply to the UK.<\/p>\n\n\n\n

What is the GDPR and why it has global reach<\/h2>\n\n\n\n
\n
\n
\"\"<\/figure>\n<\/div><\/div>\n\n\n\n
\n

The GDPR is the code name for the UK and the EU\u2019s General Data Protection Regulation<\/a>. It shields the personal data of individuals who are within the European Union, provides rights to the data owners (i.e. individuals) and lays out obligations for the organisations handling that data. It has a general territorial scope such that it may apply to organisations outside of the EU if certain conditions are fulfilled.<\/p>\n<\/div>\n<\/div>\n\n\n\n

<\/p>\n\n\n\n

A US company may be controlled by the GDPR if it is:<\/p>\n\n\n\n

    \n
  1. Providing goods or services to data subjects in the European Union <\/strong>(EEA and UK)<\/li>\n<\/ol>\n\n\n\n

    This trigger is independent of payment or contractual terms. A business will be deemed to be targeting or envisaging an EU audience if it engages in any of the following activity:<\/p>\n\n\n\n