Does the GDPR apply to a US company?

A common assumption among US founders is that the GDPR is a European problem for European companies. It is not. The regulation is written to follow the person whose data is processed, not the company's postal address, so a business in New York or Austin can be fully within scope while a business in Paris might not be.

Does the GDPR reach a company with no EU office?

Yes, it can. Article 3(2) applies the GDPR to a controller or processor that is not established in the Union when its processing relates to offering goods or services to people who are in the EU, or to monitoring their behaviour as it happens in the EU. There is a second route in: Article 3(1) applies the regulation to any processing carried out in the context of an EU establishment, wherever the processing itself takes place. So an EU branch or subsidiary pulls you in even if the servers sit in the United States.

What counts as offering goods or services?

Simply having a website that Europeans can reach is not enough on its own. Recital 23 asks whether it is apparent that you envisage offering to people in the EU. The signals it lists are practical: using a language or a currency of an EU country with the ability to order in it, or mentioning customers or users who are in the EU. An English-only site priced in dollars, with no EU marketing, points away from scope. A site offering euro pricing, EU-language checkout, or EU shipping points firmly towards it.

What counts as monitoring behaviour?

Article 3(2)(b) covers monitoring the behaviour of people in the EU. Recital 24 explains this as tracking people on the internet, including profiling to analyse or predict their preferences and behaviour. In practice, common analytics, advertising pixels, and behavioural tracking aimed at or capturing EU visitors can bring a US business within scope, even where nothing is sold. If you run remarketing or detailed product analytics on EU traffic, assume this branch is in play.

If the GDPR applies, what comes first?

Two things. Many non-EU companies in scope must appoint an EU representative under Article 27, and every controller needs a valid lawful basis under Article 6 for each activity. You will also usually need a record of processing activities and data processing agreements with your vendors. The GDPR compliance hub walks through the core duties in order.

Next step

Working out whether you offer or monitor at a level that triggers Article 3 is a judgement call, and getting it wrong in either direction is costly. The free 2-minute Obligation Scan checks your setup against the territorial-scope tests and tells you whether the GDPR applies to you, then points to the representative, lawful-basis, and record-keeping steps that follow.