GDPR for US Small Businesses Serving EU Customers

If you sell to anyone in the European Union — even a single customer who found your SaaS tool, your Etsy shop, or your consulting firm through a Google search — GDPR can apply to you, regardless of the fact that your business has no office, no server, and no employee anywhere near Europe. That surprises a lot of small business owners, who assume a European privacy law is a European problem. It isn’t, and the penalties for getting it wrong are large enough that it’s worth five minutes to find out whether you’re actually exposed.

What Actually Triggers GDPR for a US Business

GDPR doesn’t care where your business is incorporated. It applies to any organization — anywhere in the world — that either offers goods or services to people located in the EU, or monitors the behavior of people located in the EU (think analytics, retargeting ads, or tracking cookies). A US-based legal expert’s blunt summary of this rule: having no office or branch in the EU is not a defense. If you have a contact form a German visitor can fill out, a checkout page that ships to France, or an ad pixel tracking EU visitors across your site, you’re in scope. Simply being found by EU visitors through organic search, with no active marketing toward them, is a grayer area, but deliberately offering goods or services to EU residents — pricing in euros, shipping to EU addresses, EU-language versions of your site — puts you squarely inside the regulation.

Lawful Basis: You Need a Reason to Hold the Data

Every piece of EU personal data you process needs a documented lawful basis — consent, contract performance, or legitimate interest are the three a small business will use most. If you’re relying on consent (for a newsletter signup, for example), it has to be specific, informed, and as easy to withdraw as it was to give. A pre-checked box or a vague “by using this site you agree” clause in your terms doesn’t meet the bar. A clear opt-in checkbox, unchecked by default, tied to a specific purpose, does.

Data Subject Rights You Have to Be Ready to Honor

EU residents have the right to access the data you hold on them, correct it, have it erased, restrict its use, receive a portable copy, and object to processing — including objecting to being profiled by an automated decision with no human review. You generally have one month to respond to a request, extendable by two more months for a genuinely complex one. In practice, this means you need to actually know where EU customer data lives in your business — your CRM, your email platform, your invoicing tool — well enough to pull a complete, accurate copy within that window if someone asks.

The 72-Hour Breach Notification Clock

If you discover a breach that risks EU residents’ rights or freedoms, you have to notify the relevant supervisory authority within 72 hours of becoming aware of it, and notify the affected individuals directly if the risk is significant. Seventy-two hours is not a lot of time once you account for figuring out what actually happened, so this is one more reason a basic incident response plan that names who does what during a breach is worth having before you need it, not after.

Do You Need a DPO? Probably Not

A Data Protection Officer is only mandatory if you’re a public authority, you do large-scale systematic monitoring of individuals as a core activity, or you process large-scale special-category data like health records. Most small businesses serving a handful of EU customers don’t clear any of those bars. You still need someone internally who owns privacy compliance — it just doesn’t have to be a dedicated, titled role.

The Recordkeeping Exemption That Actually Helps Small Business

Businesses with fewer than 250 employees get a real break here: you’re generally exempt from maintaining the full written Article 30 processing records, unless your processing is regular (not occasional), involves special-category data, or risks individuals’ rights. If you’re a 10-person shop collecting names and emails for order fulfillment, you likely fall under this exemption — but document the reasoning, because “we assumed we were exempt” is a worse position to be in during an inquiry than a one-page note explaining why.

What the Fines Actually Look Like

GDPR penalties come in two tiers: up to €10 million or 2% of global annual revenue (whichever is higher) for less severe violations, and up to €20 million or 4% of global annual revenue for the serious ones — failing to get a lawful basis, ignoring data subject rights, or a serious breach handled badly. For a small business, the percentage-of-revenue framing matters more than the headline euro figure: fines scale to the size of the business being fined, and regulators have shown willingness to pursue small and mid-sized companies, not just the household names that make headlines.

International Data Transfers: The EU-US Data Privacy Framework

The mechanism that currently allows U.S. companies to lawfully receive personal data from the European Union is the EU-U.S. Data Privacy Framework (DPF), which the European Commission adopted in July 2023. It replaced the earlier Privacy Shield arrangement, which the Court of Justice of the European Union struck down in 2020 (the “Schrems II” ruling) over concerns that U.S. government surveillance programs lacked adequate safeguards for European residents’ data. The DPF was built specifically to address those concerns, adding an independent Data Protection Review Court that EU citizens can use to challenge U.S. intelligence-agency access to their data. The framework has already faced at least one direct legal challenge: French politician Philippe Latombe asked the EU’s General Court to annul the Commission’s adequacy decision, arguing the Review Court was not sufficiently independent and that U.S. bulk data collection lacked proper limits. In September 2025, the General Court rejected both arguments and upheld the framework, though further appeals to the EU’s top court remain possible and privacy advocacy groups have signaled they may keep pressing the issue. For now, the DPF is the current, Commission-approved legal basis for these transfers.

For a small business, using the DPF means self-certifying through the U.S. Department of Commerce’s Data Privacy Framework Program. That involves submitting an application confirming your privacy policy meets the framework’s principles (notice, choice, accountability for onward transfer, security, data integrity, access, and recourse), publicly posting a DPF-compliant privacy policy, and renewing the certification annually. There’s no fee beyond the modest Commerce Department processing cost, and most small businesses can complete the self-certification process themselves without hiring outside counsel, though the privacy policy itself is worth drafting carefully since the certification is legally binding and enforceable by the FTC.

If you skip self-certification, you can still legally receive EU personal data, but you’ll need a different legal mechanism — almost always Standard Contractual Clauses (SCCs), a set of EU Commission-approved contract terms signed between you and the EU party sending the data. SCCs work, but they require more paperwork per relationship (a signed contract for every EU data source, rather than one annual self-certification covering all of them), and some EU companies increasingly prefer dealing with DPF-certified U.S. vendors specifically because it’s simpler for their own compliance file. See our data privacy laws for small business guide for how the DPF fits alongside state and other privacy obligations.

Bottom Line

Most US small businesses that casually sell to a few EU customers aren’t a regulatory target, but “probably fine” isn’t the same as compliant, and the exposure is real the moment you deliberately market to or track EU residents. Start with the cheap parts: a real opt-in for marketing emails, a privacy policy that actually describes what you collect and why, and a named person who knows what to do if an EU customer emails asking what data you have on them. That covers the majority of the actual regulatory risk for a business this size, without needing to hire outside counsel before you’ve made a single euro in EU revenue.