EU GDPR for Businesses Selling into Europe

The EU General Data Protection Regulation (GDPR) has extraterritorial reach - it applies not only to businesses established in the EU but to any business that targets EU residents, regardless of where the business is based. If you offer goods or services to people in the EU, or monitor the behaviour of EU residents, you are subject to EU GDPR. Here is what that means in practice.

The extraterritorial reach of EU GDPR

Article 3 of EU GDPR sets out its territorial scope. It applies to businesses established in the EU (obviously), but also to businesses outside the EU that: offer goods or services to individuals in the EU (even free services), or monitor the behaviour of individuals who are in the EU.

The European Data Protection Board (EDPB) has clarified that 'offering' requires an intention to offer - simply having a website accessible from the EU is not sufficient. Indicators of intentional targeting include: mentioning EU member states, using EU languages or currencies, allowing EU-based delivery, or having EU-specific marketing.

• If you actively market to EU residents, charge EU currencies, or localise your site for EU visitors - EU GDPR applies
• EU GDPR is separate from UK GDPR - Brexit created two parallel regimes; compliance with one does not mean compliance with both
• Violations can be enforced against non-EU businesses by EU supervisory authorities, who can impose fines and issue orders to cease processing

Key obligations for businesses outside the EU

If EU GDPR applies to you, you must comply with all its requirements - not a subset. The main obligations include:

• Lawful basis: identify and document your lawful basis for processing EU residents' personal data
• Privacy notice: provide a GDPR-compliant privacy notice to EU residents covering all required information
• Data subject rights: respond to access requests, erasure requests, portability requests and objection within required timescales
• Data processing agreements: execute DPAs with any third parties processing EU personal data on your behalf
• Records of processing activities (ROPA): maintain a documented record of all processing activities
• Data breach notification: notify the relevant EU supervisory authority within 72 hours of a notifiable breach
• Data protection by design and by default: integrate data protection into your systems and processes from the outset

Article 27 - EU Representative requirement

If you are established outside the EU but subject to EU GDPR, you are likely required to appoint an EU Representative. This is a designated contact point for supervisory authorities and EU data subjects.

The EU Representative must be established in an EU member state where your EU data subjects are located. You must name the Representative in your privacy notice and record them in your ROPA. The Representative can receive enforcement correspondence from supervisory authorities on your behalf.

Exemptions: the requirement does not apply if your processing is occasional, involves no large-scale processing of special categories of data, and is unlikely to risk the rights of individuals. In practice, most businesses with meaningful EU sales volume will need to appoint a Representative.

Cross-border data transfers from the EU

EU GDPR restricts the transfer of personal data outside the European Economic Area (EEA) - which includes EU member states plus Norway, Iceland and Liechtenstein. Transfers to non-EEA countries require an appropriate transfer mechanism:

• Adequacy decision: the European Commission has recognised certain countries as providing adequate protection (the UK, Japan, South Korea, and others) - transfers to adequate countries can proceed without additional safeguards
• Standard Contractual Clauses (SCCs): the most widely used mechanism for transfers to countries without adequacy - EU SCCs must be incorporated into your contracts with EU data exporters
• Binding Corporate Rules (BCRs): used for intra-group transfers within multinational companies
• GDPR derogations: available for specific situations including explicit consent, performance of a contract, or important public interest - not suitable for systematic transfers

Practical steps to EU GDPR compliance

• Conduct an honest assessment of whether EU GDPR applies to your business - consider your marketing, your customer base, your website
• If it applies, conduct a gap analysis against the full EU GDPR requirements
• Update your privacy notice to be EU-GDPR compliant and accessible to EU visitors
• Appoint an EU Representative if required - specialist services exist to provide this
• Execute the EU Standard Contractual Clauses with any EU-based data exporters who transfer data to you
• Build a data breach notification process that covers the 72-hour supervisory authority notification window
• Engage EU GDPR-qualified counsel - EU GDPR is complex and enforcement is active

Back to all guides