GDPR compliance for US companies: The Essential guide

The General Data Protection Regulation (GDPR) is the EEA’s most comprehensive privacy law, setting clear rules for how companies collect, use, and protect personal data. It gives individuals the right to access, delete, or transfer their data, and requires companies to prove they have a valid reason for processing it.

In 2025, US companies can’t afford to ignore GDPR. Enforcement is ramping up, cookie-consent violations are drawing heavy fines, and the new EEA–US Data Privacy Framework has pushed compliance back into the spotlight.

Still think GDPR “only applies in Europe”? Think again.

If your business serves EEA residents, or you track behavior like IPs or clicks from the region, you’re on the hook. 

And no, a basic cookie banner isn’t enough. Consent must be informed, specific, and revocable, with detailed logs to back it up.This guide will walk you through GDPR compliance for US companies in 2025, what mistakes to avoid, and how to simplify compliance using automation.

Does GDPR apply to US companies?

Yes. Under Article 3 of the GDPR, the regulation’s reach extends beyond the borders of the European Union when either of the two key criteria is met: establishment and targeting. 

First, if your US company has an “establishment” in the EEA, such as a branch, office, or agent, you must comply with GDPR requirements for all your data processing activities of the EEA establishment, even if they happen outside the EEA. 

Second, even without a physical presence, GDPR still applies if your US business:

• Offers goods or services (free or paid) to residents in the EEA at the time of data processing.
• Monitors EEA user behavior via cookies, tracking pixels, analytics, or marketing tools.

In practical terms, this means that if your US e‑commerce site sells products to EEA customers, or your SaaS platform collects usage data tied to EEA IP addresses, you must meet GDPR regulations. 

GDPR applies both to organizations that decide why and how personal data is used—known as “data controllers” (for example, a U.S. marketing firm choosing how to handle customer information)—and to those that process that data on the controller’s behalf—called “data processors” (for example, a cloud provider storing EEA personal data).

Scenarios where GDPR applies:

• Web traffic and e‑commerce
  A US retailer offering checkout and shipping to EEA addresses is subject to GDPR.
  

• SaaS platforms and software services
  If your application tracks user activity, customizes experiences, or sends automated emails based on EEA user behavior, GDPR governs how you collect, store, and secure that information.
  

• Email collection and marketing
  Collecting email addresses from EEA prospects, whether for newsletters or promotions, requires a lawful basis (such as explicit consent) and transparent notice of how their data will be used.
  

GDPR requirements for US companies

As a US company now subject to GDPR, you'll need to put several key elements in place, not just to avoid penalties, but to respect individual rights and build lasting trust.

1. Collect consent and identify a legal basis

Every time you process EEA personal data—whether collecting email addresses, using tracking cookies, or profiling users—you need a legal footing. That means relying on one of six lawful bases under Article 6. 

These include consent, contract, legal obligation, vital interests, public task, or legitimate interest.  If you rely on consent, it must be freely given, specific, informed, and easily withdrawable. 

Creating a reliable record of each user’s choices not only helps compliance but also demonstrates respect for user autonomy. Picking and documenting the right legal basis isn’t just about compliance, but ensures your data use is ethical and defensible.

2. Display clear and transparent privacy notices 

When you collect personal data—directly or indirectly—you must display a clear, comprehensive privacy notice. Under Article 13 and Article 14, this notice should spell out who you are, what data you collect, why, how long you keep it, whether it's shared internationally, and what rights users have. 

Keep the language easy to read and upfront at the point of collection, not hidden in legal jargon. A transparent privacy policy builds trust and ensures both users and regulators know what you’re doing with their data.

3. Enable data subject rights; it’s  non-negotiable

GDPR gives EEA individuals rights such as accessing, correcting, deleting, or transferring their data, and you have just one month to respond. Offering a self-service platform or streamlined request process not only meets GDPR requirements but also improves user satisfaction.

4. Keep a detailed record of your processing (RoPA)

Under Article 30, you’re required to track your collection and use of data: what you collect, why, who has access, how long you retain it, and what safeguards you’ve implemented. However, there are exemptions. For example, controllers employing fewer than 250 people need not keep RoPA unless the processing is likely to result in a risk to the rights and freedoms of data subjects, is not occasional, or includes special categories.

Although you may not need to publish this, it must be available to regulators and is essential for internal oversight. A properly maintained RoPA gives you clarity, control, and confidence—internally and during audits.

5. Do DPIAs for high-risk activities

If your processing activity could seriously affect people’s privacy—like profiling, analyzing behavior, or processing sensitive data—you must complete a Data Protection Impact Assessment (DPIA). It's a structured way to identify, evaluate, and mitigate privacy risks proactively.

DPIAs help you think ahead, preventing privacy issues before they become problems.

6. Appoint an EEA representative and, if needed, a DPO

If GDPR applies to your business but you don’t have an office in the EEA, you’ll need to appoint an EEA-based representative to handle questions from regulators and users. Do note that a representative is required only if Article 3(2) applies, subject to the exemptions in Article 27.

For example, a US company that rarely sells to EEA customers and doesn't systematically target the EEA market may not need a representative. But if you actively market to EEA residents, accept EEA currencies, offer EEA-specific shipping, or regularly process customer data, you'll need one.

If your core activities involve large-scale data processing or handling sensitive data, appointing a Data Protection Officer (DPO) is also required. The DPO brings expert oversight and ensures your compliance efforts stay on track.

What happens if you don’t comply?

Failing to meet GDPR requirements exposes your US company to significant risks, both legally and commercially. These include:

Penalties and fines 

GDPR violations can lead to hefty fines: up to €20 million or 4% of global annual turnover, whichever is higher.

• Meta Platforms Ireland faced a historic €1.2 billion fine in May 2023 for transferring EEA data to the U.S. without adequate safeguards under Article 46 GDPR. 
• Clearview AI was fined €30.5 million in September 2024 by the Dutch Data Protection Authority for illegal biometric data collection and non-compliance.
  
• Uber was hit with a €290 million penalty by Dutch authorities over improper data transfers linked to EEA driver information.

Contractual rejection by EEA customers

Many European organizations and government agencies now require GDPR compliance as a baseline for doing business. Failing to present compliance evidence—like active data transfer mechanisms or privacy certifications—can cost you contracts and market access.

Trust and reputation risks

Even beyond fines, data violations can severely damage your brand. News of non-compliance or consumer complaints can lead to negative media attention, lost customer confidence, and a long-lasting hit to brand reputation. This makes recovery difficult, potentially impacting growth and retention.

By addressing GDPR requirements for US companies upfront and maintaining sound privacy practices, you can protect your company from fines, preserve customer trust, and stay competitive in European markets.

Steps to achieve GDPR compliance in the US

Becoming GDPR-compliant is more than a checklist. It’s about embedding privacy into every part of your organization. Here’s a step-by-step breakdown to help you do just that: 

1. Map your data flows

Start by identifying every point where EEA personal data enters your systems—whether through web forms, cookies, analytics, or support tools. Recording who collects what data, where it is stored, and who has access to it provides a clear view of your data exposure and helps prevent accidental misuse or leakage.

This helps you gain an accurate map that prevents surprises later and supports targeted privacy efforts.

2. Classify personal data comprehensively

Not all data carries the same risk. By sorting information into identifiers (like names and emails), technical data (like IP addresses and device IDs), and sensitive categories (such as health details), you control what to protect. This fine-grained classification directs your security efforts where they're most needed, rather than wasting resources.

By doing this, you reduce risk exposure and improve efficiency by protecting only what truly needs protection.

3. Identify lawful processing basis

Every repository or processing activity must rely on a valid legal justification under Article 6. Whether it’s consent, contract necessity, or legitimate interest, documenting the rationale and matching it to each type of data ensures legal clarity and transparency.

You can confidently explain your data use to users and regulators, and avoid legal ambiguity.

4. Set up consent and opt-out processes

When you rely on consent or tracking mechanisms, give users real choice. A consent banner with granular options, paired with clearly phrased privacy language, lets individuals decide who collects what and why. Log all preferences for future reference. 

This builds trust, ensures audit readiness, and meets GDPR for informed consent.

5. Prepare for Data Subject Access Requests (DSARs)

GDPR requires you to respond to users' requests—whether to access, delete, or export their data—within one month. Whether using automation or a manual system, having a clear process ensures every DSAR is handled efficiently, consistently, and within legally acceptable timeframes.

By doing this, you demonstrate accountability and improve user confidence, while staying compliant.

6. Build security and breach notification protocols

Article 32 requires  safeguards like encryption, access controls, and regular testing. Combined with timely breach-response protocols under Article 33 and Article 34—such as notifying authorities within 72 hours—this ensures your systems are proactive rather than reactive.

This helps you to reduce breach impact, demonstrate responsible risk management, and build legal resilience.

How Scrut helps US companies with GDPR

When GDPR requirements for US companies feel overwhelming, Scrut turns complexity into clarity, helping you stay compliant without adding manual work or headaches.

Pre‑mapped compliance framework

Instantly align your processes with GDPR articles using Scrut’s built‑in control mappings. Instead of spending days translating legal language into technical tasks, you can see exactly which policies and procedures address each GDPR obligation, so your team can act on clear next steps rather than guesswork.

Ready‑to‑use policy templates

Skip drafting from scratch by customizing professional privacy notices, DSAR workflows, and data‑processing agreements. These templates already include the required elements—legal bases, user rights, transfer details—so you get a compliant policy live in hours, not weeks, freeing you to focus on your customers instead of boilerplate language.

Automated evidence gathering and monitoring

Let Scrut collect consent logs, access records, and breach notifications across your systems. When it’s time for an audit, you’ll have a single source of truth. No more piecing together spreadsheets or scrambling for screenshots. This continuous monitoring means you spot potential gaps immediately and demonstrate compliance at the click of a button.

Centralized compliance dashboards

Gain complete visibility into your GDPR program with live dashboards that track RoPA updates, DPIA progress, DSAR completion rates, and cookie‑consent status. With all key metrics in one place, you’ll confidently show stakeholders and regulators where you stand, turning reporting from a scramble into a routine status check.

Multi‑framework support

Manage compliance for regulations such as GDPR alongside CCPA, and standards like ISO 27001, without juggling multiple tools. Scrut’s unified platform enables you to reuse controls and evidence across frameworks, reducing duplication and lowering your compliance overhead, allowing you to meet US and EEA privacy laws in parallel.

Handling EEA data from the US? 

Schedule a demo to see how Scrut automates policy mapping, consent tracking, DSAR workflows, DPIAs, and ongoing monitoring, so you can manage GDPR compliance with confidence and scale.

Frequently Asked Questions

What's the difference between a Data Protection Officer (DPO) and an EU Representative?

A DPO is an internal or external expert required when your core activities involve large-scale systematic monitoring or processing of sensitive data. They oversee your entire privacy program and report to your highest management level. An EU Representative, required under Article 27, acts as your local contact point for EU regulators and data subjects when you have no EU establishment.

Can one person or company serve as our EU Representative for multiple EU countries?

Yes, one representative can cover all EU member states where you process personal data. They should be based in one of the EU countries where your data subjects are located. Many US companies use specialized firms that provide EU representation services across multiple jurisdictions.

We're a B2B SaaS company. Does GDPR apply if we only have EU business customers, not consumers?

Yes, GDPR protects all EU personal data, including B2B contacts. Employee data from your EU business customers (like email addresses, names, or usage data tied to individuals) is protected under GDPR. You'll need proper data processing agreements with your EU business customers and must respect the rights of their employees whose data you process.

How do we handle GDPR compliance for data we collected before we knew about these requirements?

Review the original basis for collection. If you had valid consent or another lawful basis that meets GDPR standards, document it. If not, you need to either obtain fresh consent, identify another valid legal basis (like legitimate interest), or delete the data. Many companies conduct a "re-consenting" campaign for their EU database to ensure compliance.