GDPR for US Companies: When It Applies to a B2B Firm

Article 3 of the GDPR sets the territorial scope. A US firm is covered in two main cases.

• You have an establishment in the EU. If your data processing happens in the context of an EU office, the law applies, whether or not the data is handled in the EU.
• You target people in the EU. If you have no EU office, the law still applies if you sell or provide goods or services to people located in the EU, whether or not they pay. It also applies when you monitor their behavior inside the EU.

The second test is the one that surprises US firms. It is called the targeting test. It looks at what you do, not where you are based.

Sources: GDPR Article 3, Territorial scope (Regulation (EU) 2016/679, in force since May 2018)

Yes, it can. The GDPR protects natural persons, meaning real people. It does not cover data about companies as such. Recital 14 says so.

But most B2B data is about people. Article 4 defines personal data as any information about an identified or identifiable person. A name, a work email address, a job title and a phone number can all qualify. A CRM full of buyer contacts at EU companies is personal data, even though the buyers act for their employers.

So the question is not "do we sell to consumers?" The question is "do we handle information about people who are in the EU?"

Sources: GDPR Recital 14, Not applicable to legal persons; GDPR Article 4, Definitions

The European Data Protection Board (EDPB) published final guidelines on this test in November 2019 (Guidelines 3/2018 on territorial scope). The board says the test turns on whether you plainly intend to reach people in the EU.

Recital 23 of the GDPR says that having a website that EU visitors can open is not enough. Neither is having an email address or using English. Signs of intent include:

• Naming an EU country or Member State in your offer.
• Paying for search or social ads aimed at an EU country.
• Showing prices in euros, or offering a site in German, French or another EU language.
• Using an EU domain such as ".de" or ".eu", or listing a phone number for callers from the EU.
• Naming customers in EU countries as clients.

The second prong covers monitoring. Tracking people online counts, for example with cookies or analytics that profile EU visitors, if the behavior takes place in the EU.

The guidelines also say where the person's passport comes from does not matter. The key point is that the person is physically in the EU at the time of the offer or the tracking.

Sources: EDPB, Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), version 2.0 adopted 12 November 2019; GDPR Recital 23

Situation	Likely result
A US software firm answers a stray inquiry from a Dutch buyer	Probably outside the targeting test. Nothing shows intent to reach the EU.
The same firm runs ads in Germany, sells in euros and has a German-language page	Likely inside the targeting test.
A US firm sends cold email campaigns to a list of French and Spanish managers	Likely inside. It is aimed at people in the EU.
A US firm tracks EU visitors with profiling cookies	Possibly inside, under the monitoring prong.

These are judgment calls, and regulators look at the full set of facts. The EDPB notes that factors may be weighed in combination.

Sources: EDPB, Guidelines 3/2018, section 2 on the targeting criterion. The table rows are illustrative, not rulings.

If the targeting test applies to you, Article 27 requires a written designation of a representative in the EU. This is a person or firm in one of the Member States where your data subjects are. Regulators and individuals can contact the representative on your behalf.

There are two exceptions. You may skip it when your processing is only occasional, avoids large-scale sensitive data, and is unlikely to endanger people's rights. Public authorities are also exempt. The EDPB says a firm that should have a representative and does not is in breach of the law.

The representative is not a legal shield. The law says naming one does not stop regulators from acting against your company itself.

Sources: GDPR Article 27, Representatives of controllers or processors not established in the Union; EDPB, Guidelines 3/2018, section 4

1. Map your EU contacts. Find where EU personal data sits: the CRM, email tools, web analytics and support desk.
2. Run the two tests. Write down whether you have an EU office, whether you target EU buyers, and whether you track EU visitors.
3. Pick a legal basis. For B2B outreach this is often "legitimate interests" under Article 6, which needs a written balancing check. Note that email marketing rules in each EU country can add their own limits.
4. Give notice. Article 13 requires you to tell people who you are, why you use their data, how long you keep it and what rights they have. Add a clear privacy notice.
5. Be ready for requests. People can ask for access to their data or for deletion. Set an owner and a process.
6. Check transfers and vendors. Sending EU data to the US needs a valid transfer tool. Sign data processing terms with vendors that handle it.
7. Name a representative if Article 27 applies. Put the contact in your privacy notice.

Sources: GDPR Article 6, Lawfulness of processing; GDPR Article 13, Information to be provided where personal data are collected from the data subject; GDPR Articles 44 to 49, Transfers to third countries

Article 83 sets two fine levels. Breaches of core rules, such as the basic principles, consent conditions and individual rights, can draw fines of up to 20 million euros or 4 percent of worldwide annual turnover, whichever is higher. Lesser breaches, including failing to name an Article 27 representative, can draw up to 10 million euros or 2 percent. These are maximums, and regulators weigh the facts of each case.

For a mid-sized US firm, the bigger day-to-day risk is often lost deals. EU buyers increasingly ask suppliers for privacy terms in procurement. Clear answers help close sales. Our guide to third-party risk management shows what buyers tend to ask.

Sources: GDPR Article 83, General conditions for imposing administrative fines

1. Regulation (EU) 2016/679 (GDPR), Article 3, Territorial scope. gdpr-info.eu/art-3-gdpr
2. GDPR Article 4, Definitions. gdpr-info.eu/art-4-gdpr
3. GDPR Article 13, Information to be provided. gdpr-info.eu/art-13-gdpr
4. GDPR Article 27, Representatives of controllers or processors not established in the Union. gdpr-info.eu/art-27-gdpr
5. GDPR Article 83, General conditions for imposing administrative fines. gdpr-info.eu/art-83-gdpr
6. GDPR Recital 14, Not applicable to legal persons. gdpr-info.eu/recitals/no-14
7. European Data Protection Board, Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), version 2.0, 12 November 2019. edpb.europa.eu