Does GDPR Apply to My Business Outside the EU? A Plain-English Test

“We are not in Europe, so GDPR does not apply to us.” I hear it from founders in Karachi, Dubai, Bangalore and Austin, and it is often wrong. The General Data Protection Regulation was written to follow personal data, not company addresses. This guide gives you a plain-English test, with examples, so you can tell whether it reaches your business.

For a quick first answer across several laws at once, try the free Privacy Law Applicability Checker.

The rule: Article 3

GDPR applies in two main ways.

Article 3(1), the establishment test. If you have an establishment in the EU, such as a branch, office or even a single representative carrying out real activity, GDPR applies to processing in the context of that establishment’s activities, wherever the processing takes place.

Article 3(2), the targeting test. If you have no EU establishment, GDPR still applies where you process personal data of people who are in the EU and the processing relates to:

• (a) offering goods or services to them, whether or not payment is required; or
• (b) monitoring their behaviour, as far as that behaviour takes place in the EU.

Most non-EU businesses are caught, if at all, by Article 3(2). So the practical questions are: are you offering to people in the EU, and are you monitoring them?

Test 1: are you offering goods or services to people in the EU?

The key word is intention. Simply having a website that someone in Germany can open is not enough. The European Data Protection Board’s territorial scope guidelines, drawing on Court of Justice case law such as Pammer and Hotel Alpenhof, point to factors that show you envisage offering to people in the EU, including:

• using an EU language that is not commonly used in your own country;
• pricing in euros or another EU currency;
• offering delivery to EU Member States;
• mentioning EU customers, or dedicated EU phone numbers or addresses;
• marketing aimed at EU audiences, such as paid search campaigns targeting EU countries;
• an EU country-code domain, such as .de or .fr;
• describing travel instructions from EU countries, for a business like a hotel.

No single factor decides it. Regulators look at the overall picture.

Examples

• A Pakistani SaaS company sells subscriptions worldwide, prices in euros as one option and runs ads in Germany and France. It is offering services to people in the EU. GDPR applies to that processing.
• A US restaurant has a website in English, prices in dollars, and takes bookings only for its Chicago premises. An EU tourist books a table. That alone does not mean it targets the EU.
• An Indian e-commerce store ships to Ireland and the Netherlands and has a checkout that accepts euros. It is offering goods in the EU.

Test 2: are you monitoring behaviour in the EU?

Monitoring covers tracking people’s behaviour online, especially to profile them, analyse preferences or predict behaviour. Examples include behavioural advertising, tracking through cookies and similar technologies for profiling, location tracking through apps, and certain analytics that build individual profiles. If people in the EU use your app or site and you profile their behaviour, Article 3(2)(b) can apply even if you never sell them anything.

For AI and SaaS businesses this matters because product analytics and personalisation often involve exactly this kind of tracking.

Who counts as “in the EU”?

Article 3(2) protects people who are physically in the EU when the processing relates to them. It is not about citizenship. An EU citizen living in Canada is not, for that reason, protected against a Canadian business under Article 3(2). A Pakistani citizen on holiday in Spain, using a service aimed at the EU, may be.

If GDPR applies: what changes

Being in scope brings the full regulation into play for the relevant processing, including:

• a lawful basis for each purpose of processing;
• transparency information under Articles 13 and 14 (your privacy policy; see the privacy policy checklist for SaaS and AI apps);
• data subject rights: access, rectification, erasure, restriction, objection and portability;
• records of processing, security measures and breach notification;
• data processing agreements with processors (see DPAs explained);
• rules on transfers of personal data;
• data protection impact assessments for high-risk processing.

The EU representative (Article 27)

Non-EU controllers and processors caught by Article 3(2) must generally appoint a representative in an EU Member State where the individuals concerned are located. The representative is a point of contact for individuals and regulators. The exception is narrow: processing that is occasional, does not include large-scale special category or criminal offence data, and is unlikely to result in a risk to individuals (and public authorities). Many small non-EU businesses overlook this requirement entirely.

Fines

GDPR fines reach up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious breaches. Enforcement against companies with no EU presence is harder in practice, but EU regulators have acted against non-EU businesses, and EU customers, partners and platforms increasingly require GDPR compliance contractually before they will do business with you.

The UK GDPR

Since Brexit, the United Kingdom has its own version, the UK GDPR, alongside the Data Protection Act 2018. It uses the same establishment and targeting tests for people in the UK and has its own representative requirement. A business targeting both the EU and the UK may need to address both.

A five-question self-test

1. Do we have any establishment, office, staff or representative activity in the EU or UK?
2. Do we use EU languages, currencies, domains, delivery or marketing aimed at people in the EU or UK?
3. Do people in the EU or UK sign up for or use our product in meaningful numbers, with our knowledge?
4. Do we track or profile users’ behaviour, for advertising, analytics or personalisation?
5. Do EU or UK customers, partners or app stores require GDPR compliance in our contracts?

If you answered yes to question 1, or to question 2 or 4 together with question 3, assume GDPR applies and plan accordingly. If you answered yes only to question 5, you may not be legally in scope but you are commercially in scope.

The bottom line

GDPR follows the people whose data you process, not the place you are incorporated. If you aim your product at people in the EU or monitor how they use it, the regulation is likely to apply. The good news is that compliance is manageable when built in early: a data map, an accurate privacy policy, sound contracts with processors and, where required, an EU representative.