What Does GDPR Mean For Companies Based Outside The EU?

Update: October 2026

The GDPR doesn’t stop at the EU’s borders. A company in the US, the UK, India or Singapore can fall under it without owning an office, a server or a single employee in Europe.

This guide covers the tests that bring a non-EU company within scope, what the EDPB says about each, when an EU representative is required, and why the separate rules on international transfers still matter.

Key Takeaways

• Article 3(2) GDPR applies to a controller or processor not established in the EU when its processing relates to offering goods or services to people in the EU, or to monitoring their behaviour in the EU. Processing the data of an EU resident is not enough on its own. The company has to be targeting people in the Union.

• A non-EU company within Article 3(2) must designate a representative in the EU in writing under Article 27, unless an exemption applies. Appointing a representative does not move responsibility. The EDPB confirms it does not affect the controller’s or processor’s liability.

• Scope and transfers are separate questions. Article 3 decides whether the GDPR applies to you. Chapter V decides how personal data may move from the EU to you, for example through the EU-US Data Privacy Framework or standard contractual clauses.

Two Tests Bring a Non-EU Company Within the GDPR

Article 3 sets out the territorial scope. Under Article 3(1), the GDPR applies to processing in the context of the activities of an establishment of a controller or processor in the Union, wherever the processing takes place. Under Article 3(2), it applies to the processing of data subjects in the Union by a controller or processor not established there, where the processing relates to offering them goods or services or monitoring their behaviour.

The EDPB’s Guidelines 3/2018 on territorial scope call these the establishment criterion and the targeting criterion. If either is met, the relevant provisions of the GDPR apply to the processing.

An EU Office Can Pull Processing Into Scope

The establishment test does not require the whole business to be in the EU. The EDPB gives an example of a Chinese e-commerce website with an office in Berlin that runs marketing campaigns towards EU markets. It concludes that the website’s processing in connection with EU sales is inextricably linked to the Berlin office’s activities, so it falls under Article 3(1).

The guidelines also state that designating a representative under Article 27 does not make the representative an establishment under Article 3(1).

Offering Goods or Services Requires Intent to Target the EU

Article 3(2)(a) covers offering goods or services to people in the Union, whether or not payment is required. The EDPB states that processing the personal data of an individual in the Union is not sufficient by itself. The company has to target people in the EU.

The EDPB lists factors that, in combination, can show a company is directing its offer at the EU. They include naming the EU or a Member State, paying for search advertising or running campaigns aimed at an EU audience, using a top-level domain such as “.de” or “.eu”, a language or currency used in EU countries, dedicated phone numbers reachable from EU countries, a clientele described as being in various Member States, and delivery of goods to EU Member States.

Recital 23 limits the test. The mere accessibility of a website in the EU, or an email address or a phone number without an international code, does not by itself show an intention to offer goods or services there. The EDPB’s example of a Turkish photo-album website offered in four EU languages, priced in euros and delivering to specific EU countries shows the other side: those facts demonstrate an intention to offer services in the EU.

Monitoring Behaviour Covers Tracking and Profiling

Article 3(2)(b) covers monitoring the behaviour of people in the EU, as far as the behaviour takes place there. Recital 24 refers to tracking people on the internet and to profiling. The EDPB notes that Article 3(2)(b) does not expressly require an intention to target, although the word “monitoring” implies the controller has a specific purpose for collecting and reusing the data. It does not treat any online collection or analysis of data about people in the EU as automatically monitoring, and it considers the purpose and any behavioural analysis or profiling.

The EDPB lists activities that can amount to behavioural monitoring, including behavioural advertising, geo-localisation for marketing, online tracking through cookies or fingerprinting, personalised health analytics services, CCTV and market surveys based on individual profiles. Therefore, it is worth reviewing analytics and advertising tags on a website that EU visitors use.

The guidelines also say that processing the data of EU citizens or residents in a third country does not trigger the GDPR if it is not related to a specific offer directed at people in the EU or to monitoring of their behaviour there. The EDPB gives the example of a third-country company that manages salary payments for staff who happen to live in France and Italy as processing outside Article 3(2).

An EU Representative Is Required Unless an Exemption Applies

Under Article 27(1), a controller or processor within Article 3(2) must designate a representative in the Union in writing. Article 27(2) exempts processing that is occasional, does not include large-scale processing of special category or criminal offence data, and is unlikely to pose a risk to people’s rights and freedoms, as well as to public authorities and bodies. The representative must be established in one of the Member States where the people whose data is processed are located.

Under Article 27(4), supervisory authorities and data subjects may address the representative, in addition to or instead of the controller or processor, on all issues related to processing. The EDPB says a law firm, consultancy, or other organisation established in the EU can fill the role, and that one representative can act for several non-EU companies. It also says the role is not compatible with that of an external DPO or a processor for the same controller.

The controller must tell people who the representative is. The EDPB points to Articles 13(1)(a) and 14(1)(a): the identity of the representative belongs in the privacy notice. Failing to inform people of it is a breach of transparency obligations.

Responsibility stays with the company. Article 27(5) says the designation is without prejudice to legal actions that could be started against the controller or processor themselves. See our EU representative service for how the appointment works in practice. UK GDPR has its own representative rule for overseas organisations, covered by our UK representative service.

Scope and Transfers Are Separate Questions

A non-EU company subject to the GDPR under Article 3(2) usually also receives personal data transferred from the EU. Chapter V then asks whether each transfer has a route: an adequacy decision, safeguards such as standard contractual clauses, or a derogation.

For US companies, the EU-US Data Privacy Framework adequacy decision of 10 July 2023 is one route for certified organisations. The General Court dismissed an action against it on 3 September 2025, and an appeal is pending at the Court of Justice as Case C-703/25 P, according to the Official Journal notice. The old Privacy Shield was invalidated in 2020, so organisations that relied on it have since needed another route. Our guide to transferring personal data outside the EU covers the routes and the assessment behind them.

A Short Scoping Exercise Gives You an Answer

List the markets you sell to and the countries your website and advertising target. Check the EDPB factors against your site: languages, currencies, domains, delivery countries and EU-aimed campaigns. Review analytics, advertising and tracking tools for behavioural monitoring of people in the EU. Record the conclusion and the reasons, since the accountability principle in Article 5(2) applies once you are in scope.

If you are in scope, appoint a representative unless an Article 27(2) exemption applies, add its details to your privacy notice, check whether Article 30 requires you to keep a record of processing activities, and put a transfer route in place for data coming from the EU. Other countries’ privacy laws may apply at the same time, so repeat the exercise for each market. GDPRLocal helps organisations run scoping assessments and appoint representatives. See our GDPR consultant services.

Conclusion

The GDPR applies to a company outside the EU when it has an EU establishment whose activities are linked to the processing, or when it targets people in the EU by offering goods or services or monitoring their behaviour. Holding data about an EU resident, or having a website EU visitors can access, does not, on its own, bring a company into scope.

For companies that are in scope, the practical steps are an EU representative, a clear privacy notice and a lawful route for data arriving from the EU. The company remains responsible for compliance, regardless of which representative it appoints.

Frequently Asked Questions

Does the GDPR Apply to a Company Outside the EU?

Yes, if its processing falls within Article 3. That means it has an EU establishment linked to the processing, offers goods or services to people in the EU, or monitors their behaviour there. The EDPB says processing an EU resident’s data isn’t enough without that targeting.

Does a Non-EU Company Need an EU Representative?

Yes, if Article 3(2) applies, unless an exemption in Article 27(2) covers the processing. The exemptions are for occasional, low-risk processing that does not include large-scale special category or criminal offence data, and for public authorities and bodies.

Does Appointing an EU Representative Transfer Our Liability?

No. The EDPB states that designating a representative does not affect the responsibility or liability of the controller or processor. Article 27(5) also preserves the right to bring legal actions against the controller or processor.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.