Does GDPR apply to your company if it’s outside the EU? The two tests, with examples

The GDPR does not stop at the EU’s borders. A company in London, Geneva, Montreal, New York or Casablanca can be bound by it, and Article 3 of the regulation decides when, with two tests: whether you have an establishment in the EU, and whether you target people who are in the EU, by offering them goods or services or by monitoring their behaviour. So GDPR does apply to non-EU companies, but not to all of them, and not to everything they do.

I work between London and Paris, with clients in both countries, so this guide also looks at the question the other way round: EU companies selling to the UK, which kept its own copy of the rules after Brexit. For the rest of the regulation, start with my complete GDPR guide.

Does GDPR apply to non-EU companies? The two tests in Article 3

Article 3 of the GDPR sets its territorial scope. The European Data Protection Board (EDPB), which brings together the EU’s data protection authorities, calls the two tests the establishment criterion and the targeting criterion, and explains both in its Guidelines 3/2018 on territorial scope.

Passing one test is enough. It brings the GDPR in for the processing linked to it: the data of your customers in the EU, the tracking of your visitors there. Your payroll in Texas does not become an EU matter because you sell to customers in Germany.

Test 1: do you have an establishment in the EU?

Recital 22 of the GDPR describes an establishment as “the effective and real exercise of activity through stable arrangements”, whatever its legal form. A subsidiary or a branch clearly counts, and so can an office, a warehouse or a small team on the ground.

The bar can be low. The EDPB says that in some circumstances one employee or agent acting with enough stability is sufficient, particularly for a business that sells online. A salesperson who signs up customers for you, full-time from Amsterdam, is the kind of arrangement that can qualify. A list of EU customers in your CRM is not.

If you pass this test, the GDPR applies to the processing carried out in the context of that establishment’s activities, wherever the data sits. A US company whose Dublin office sells to European clients cannot take that sales data out of the GDPR by hosting its CRM in Virginia.

Test 2: do you target people in the EU?

For a small team without an office in Europe, this is the test that matters. It has two branches, and in both the people concerned must be in the EU at the time you offer them something or track them.

Offering goods or services, paid or free

Article 3(2)(a) covers offering goods or services to people in the EU, “irrespective of whether a payment of the data subject is required”. A free newsletter, app or webinar counts as much as a paid order.

What matters is intention. Under Recital 23, it must be apparent that you envisage offering to people in one or more EU countries. The EDPB lists the signs it looks for and weighs them together, case by case.

Signs that point to the EU:

• an EU country named in your offer, such as “we deliver to France and Belgium”;
• a language or currency of an EU country that is not the usual one in your own, with the possibility of ordering in it;
• delivery of goods to EU countries;
• an EU domain name, such as .fr or .de, or the neutral .eu;
• paid search ads or marketing campaigns aimed at an EU country;
• a phone number or an address meant for customers in the EU;
• travel directions from EU countries, or reviews from customers who live there.

Not enough on its own, under Recital 23:

• your website can be opened from the EU, and people there visit it;
• your email address or phone number appears on it;
• it is written in a language used in your own country: English for a US company, French for one in Québec, Geneva or Casablanca.

Monitoring behaviour

Article 3(2)(b) covers monitoring people’s behaviour “as far as their behaviour takes place within the Union”. Recital 24 has tracking on the internet in mind, including profiling people to analyse or predict their preferences, behaviours and attitudes.

The EDPB adds that not every online collection of data is monitoring: there has to be a purpose of collecting and reusing data about how people behave. Its examples include behavioural advertising, tracking through cookies or fingerprinting, geolocation for marketing, personalised diet and health analytics online, and market studies based on individual profiles.

Six examples, from clearly in to probably out

In a real case, one detail can move the answer either way.

A US software company selling subscriptions to EU teams

A project-management tool based in Austin shows prices in euros, lists EU countries at checkout and runs LinkedIn ads aimed at Germany. That is offering services to people in the EU, so the GDPR applies to its account, billing, support and marketing data. For the files its customers store in the tool, it usually acts as their processor, bound by a contract under Article 28.

An agency in Montreal or Geneva with clients in France

Its website is in French, which proves nothing: French is a language of its home market. Quotes in euros, a page for French companies, client logos from Lyon and Google Ads aimed at France do show intent. Selling to companies rather than consumers is unlikely to take it out of scope: the names, emails and phone numbers of the people it deals with are personal data.

A UK online shop shipping to Ireland and France

It is established in the UK, so the UK GDPR covers everything it does. Its sales to people in the EU also bring in the EU GDPR for those customers’ data. With no establishment in the EU, it most likely needs an EU representative: regular sales are not the “occasional” processing the exemption covers.

An online shop in Casablanca or Tunis delivering to France

A French-language shop with prices in euros, delivery to France and Belgium, and Instagram ads aimed at Paris is offering goods to people in the EU. The GDPR applies to those customers’ data, an EU representative is needed unless the exemption applies, and the shop’s national law still applies at home.

A free app that profiles its users for advertising

A Canadian recipe app sells nothing, but it records what each user cooks and where they are, to show them targeted ads. Its users in Spain are being monitored while in the EU, so the GDPR covers that processing, payment or not.

A Chicago restaurant whose website European tourists visit

The site is in English, prices are in dollars, the meals are served in Chicago, nothing is aimed at Europe and no advertising pixel profiles its visitors. Tourists who book a table from Paris before their trip do not show any intention to target the EU, so the GDPR very probably does not apply. French and German pages for European tour groups, with ads running in Europe, could change that.

What applies once you are in scope

The whole regulation applies to the processing concerned, as it would for an EU company:

• a legal basis for each use of the data (Article 6);
• privacy information when you collect it (Articles 13 and 14), which in practice means a privacy policy with the right sections;
• people’s rights, answered within one month (Article 12(3));
• security measures, and notification of personal data breaches to the authority within 72 hours where required (Article 33);
• contracts with your processors (Article 28) and a record of your processing (Article 30).

An EU representative, in most cases

If the GDPR applies to you through the targeting test and you have no establishment in the EU, Article 27 requires you to designate, in writing, a representative in one of the EU countries where the people concerned are. The exemption is narrow: processing that is occasional, involves no large-scale sensitive or criminal-offence data and is unlikely to put people at risk, plus public bodies. My guide to the EU representative covers who needs one and how to appoint one.

No one-stop shop

An EU company working across several countries deals mainly with one lead authority, where it has its main establishment. Without an establishment in the EU you have no lead authority, and naming a representative does not create one: the authority of any EU country where your users are can act. A breach you must report goes to the authority of every EU country where affected people live.

Enforcement against companies outside the EU does happen. In May 2021 the Dutch authority, the Autoriteit Persoonsgegevens, announced a fine of 525,000 euros against Locatefamily.com for having had no EU representative since May 2018. The site published people’s addresses and phone numbers; without a representative, people struggled to get their details removed, and the authority had received 19 complaints. Breaches of Article 27 sit in the lower tier of fines: up to 10 million euros or 2% of worldwide annual turnover, whichever is higher (Article 83(4)).

Scope is not the same as transfers

Article 3 decides whether the GDPR applies to you. Chapter V, on international transfers, is a separate question about personal data passed from someone subject to the GDPR to a recipient outside the EU. In its Guidelines 05/2021, the EDPB does not treat details that people in the EU type into your website as a transfer, but passing their data on to another company outside the EU, such as a US email tool, can be one. My article on US tools and the Data Privacy Framework covers that side.

The same logic in the UK and Switzerland

Since 1 January 2021 the UK has applied its own version of the regulation, the UK GDPR, with the same two tests and “the United Kingdom” in place of “the Union”. A company in France, Ireland or Germany that sells to people in the UK or monitors them is covered for that processing, and with no UK establishment it generally needs a UK representative, with the same narrow exemption. The ICO explains who the UK GDPR applies to, and its guidance gives the example of an Irish sales firm with no UK office but a regular UK client base: it needs a UK representative.

The UK has also started to move away from the EU text. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and its changes have been brought into force in stages since then. As of 19 October 2026, several already apply, such as the higher maximum fines under PECR (the UK’s rules on marketing messages and cookies), in force since February 2026; my article on what the Data (Use and Access) Act changed has the detail. A UK company that sells into the EU therefore runs two very similar regimes side by side: build one set of policies, and note where the two differ.

Switzerland’s revised data protection act (the nFADP), in force since 1 September 2023, applies to situations that have an effect in Switzerland, even when they start abroad (Article 3). Some foreign companies must also name a Swiss representative (Article 14), but only when their processing linked to people in Switzerland is extensive, regular and high-risk at the same time. An EU representative does not count for Switzerland.

Your home law keeps applying as well: Québec’s Law 25 for an agency in Montreal, Morocco’s Law 09-08 for a shop in Casablanca.

Check your own case in seven steps

1. See where your customers are. Export orders by delivery country, and CRM contacts and newsletter subscribers by country. The figures show how much is at stake, not whether you target the EU.
2. Read your site and ads as a regulator would. Note every sign from the list above: currencies, languages, domain names, delivery countries, phone numbers, reviews, ad targeting.
3. List your trackers. Analytics, advertising pixels, session recording, the SDKs inside your app: which ones run for visitors in the EU, and do they build profiles?
4. Check for people on the ground. Someone working for you from an EU country on a stable basis can be enough for the establishment test, for the processing linked to their work.
5. Write the decision down. One dated page: in scope or not, under which test, and why. Review it whenever you add a market, a language or an ad campaign.
6. If you are in scope, update your privacy policy, ask visitors in the EU for consent before tracking them (my article on cookie banner rules shows what a valid banner looks like), appoint a representative unless you are exempt, and check the contracts and transfer terms of your tools.
7. If you would rather stay out, make the site match: no prices in euros, no delivery to the EU, no ads aimed at EU countries and no advertising profiles of visitors in the EU.

When to bring in a lawyer

This guide is general information, not legal advice. You do not need a lawyer to run the two tests on your own business: most cases are clear once steps 1 to 4 are done. One is worth paying for when the answer is borderline and the stakes are high: health or children’s data, large volumes, a complaint, a letter from an authority, or a large client asking for GDPR clauses you do not understand. The representative itself is often a specialised firm or a law firm working under a written mandate.

The website side, a consent banner that holds trackers back until visitors in the EU agree and a privacy page that names your representative, is part of the websites I build; the legal judgement stays with your lawyer.