Does the GDPR apply to my business? Explained simply

Who the GDPR reaches, and the mistake most pages make

The General Data Protection Regulation (GDPR) is the European Union's law on personal data, meaning any information about an identifiable person: a name, an email address, an IP address, a customer ID. It has applied in the EU since May 25, 2018, and in Iceland, Liechtenstein and Norway since July 20, 2018.

It reaches you in two ways. If you have an establishment in the EU (an office, a subsidiary, a branch) it covers processing done in the context of that establishment, wherever the servers are. If you have no EU establishment, it covers you when you offer goods or services to people who are in the EU, or monitor their behavior there (Article 3).

The common misstatement is that the GDPR protects "EU residents" or "EU citizens". It does neither. The test is where the person is when you target or monitor them.

A French citizen in Ohio buying from a US-only site is outside it; a Texan in Lisbon buying from a site aimed at Portugal is inside it.

"Offering" means intent. A website Europeans can open is not enough; euro pricing, an EU language you would not otherwise use, EU shipping and EU-targeted ads are the signs that count (EDPB Guidelines 3/2018).

If this route catches you, you normally also need a representative inside the EU, unless your processing is occasional, is unlikely to result in a risk to people, and involves no large-scale special category or criminal offense data (Article 27).

What it actually asks of you: seven principles and one duty to prove it

Strip away the 99 articles and the GDPR asks seven things of anyone handling personal data (Article 5). The seventh, accountability, makes the other six bite: you must be able to demonstrate compliance to the supervisory authority, not just assert it. That is why GDPR work is mostly documents rather than technology.

The six lawful bases, and why consent is usually the wrong pick

Every use of personal data needs one of six legal reasons (Article 6). Consent is one of them, not the default, and for most business uses the weakest: it can be withdrawn at any time, withdrawal must be as easy as giving it, pre-ticked boxes do not count, and a service cannot be made conditional on consent to data use it does not need (Article 7).

For everyday processing the right basis is usually contract (delivering what the customer bought), legal obligation (tax and payroll records) or legitimate interests (fraud prevention, security, mail to existing customers) after you weigh your interest against the person's rights and write that weighing down. Pick the basis before processing starts and record it.

A stricter rule covers special categories: health, biometrics used to identify someone, genetic data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life and sexual orientation. These are banned unless a listed exception applies, and the consent exception must be explicit (Article 9).

Explicit consent is also the standard when consent is the route for a solely automated significant decision (Article 22) or a one-off transfer (Article 49); everywhere else, ordinary consent applies. Pages that say the GDPR needs explicit consent for everything are wrong.

What the GDPR is not

It is not a certification. Nobody audits you against the GDPR and hands you a pass. Voluntary schemes exist (Article 42) and the European Data Protection Board keeps a register of approved ones, but a certificate is not required and does not reduce liability.

Ask any vendor with a "GDPR certified" badge which scheme.

It is not a security standard. It requires security "appropriate to the risk" and names encryption as an example (Article 32), but prescribes no algorithm or control list. A SOC 2 report or an ISO/IEC 27001 certificate is evidence for the security principle and nothing more.

It is not a US law and does not replace US state privacy laws. A company selling into the EU and to Californians answers to both, and the tests for who is covered differ.

How it works end to end

Start with a map: what personal data you hold, why, who you share it with, where it goes, how long you keep it. That becomes your record of processing (Article 30).

Organizations under 250 staff are exempt from the formal record only if their processing is occasional, is not likely to result in a risk to people, and involves no special category or criminal offense data; a company handling customer or employee data daily does not qualify.

Assign a lawful basis to each purpose and write the privacy notice (Articles 13 and 14). Then fix the contracts.

Any vendor processing personal data for you is a processor, and the law lists the terms its contract must contain: documented instructions only, staff confidentiality, security, controlled sub-processing, help with rights and breaches, deletion at the end, audit rights (Article 28). The Commission publishes optional standard clauses for this (Decision 2021/915).

Before a project likely to be high-risk to people, such as large-scale tracking, run a data protection impact assessment (Article 35).

Appoint a Data Protection Officer only if you are a public body, your core activities involve regular and systematic monitoring of people on a large scale, or your core activities involve large-scale special category or criminal data (Article 37). "We hold a lot of data" is not a trigger, whatever a checklist says.

People can ask for a copy of their data, correction, erasure, restriction, a portable copy, and to object, and not to be subject to purely automated decisions with legal or similarly significant effects unless the decision is necessary for a contract, authorized by law or based on explicit consent, with safeguards (Articles 15 to 22).

Each request gets an answer within one month of receipt, extendable by two further months for complex or numerous requests if you say so within the first month (Article 12). Requests are free unless manifestly unfounded or excessive. Erasure yields to legal retention duties; objection is absolute for direct marketing and otherwise only if you lack compelling grounds.

Breaches: notify the supervisory authority within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people, and explain any delay (Article 33). If the risk is high, tell the affected people without undue delay, unless an exception applies, such as the data being unreadable to the attacker, for example encrypted (Article 34).

A processor tells its controller without undue delay. Every breach, notified or not, goes in your log.

A worked example: a 40-person US software company

Picture a Denver software company with 40 staff, a self-serve product, checkout in dollars and euros, a German-language landing page and no staff or office in the EU. The euro pricing and German page show intent to offer the service to people in the EU, so the GDPR applies to that customer data.

(Hiring even one stable employee or agent in the EU could create an EU establishment and change this analysis, per EDPB Guidelines 3/2018.)

The company appoints an EU representative, because its processing is regular rather than occasional, and writes a record of processing. Delivering the product rests on contract; security logs and analytics on legitimate interests, with the balancing test written down; the prospect newsletter on consent, collected with an unticked box.

It signs processor terms with its cloud host, email provider and support desk.

It needs no Data Protection Officer: not a public body, no large-scale monitoring as its core business, no special category data. It has no high-risk processing, so no impact assessment yet; when it adds session recording of users, which is systematic monitoring, it assesses whether that is likely to be high risk and runs one if it is.

Collecting data directly from its EU customers is not a "transfer" under the transfer rules (EDPB Guidelines 05/2021), though the rest of the GDPR still applies. If EU business customers send it personal data to process, those are transfers, and it self-certifies to the EU-US Data Privacy Framework or signs the standard contractual clauses.

When a support agent emails a customer list to the wrong customer, it assesses the risk. Unless the breach is unlikely to result in a risk, it notifies within 72 hours every supervisory authority in a member state where affected customers live, since without an EU establishment it has no lead authority. It logs the incident either way.

Who does what, and what it costs

The European Parliament and the Council of the EU wrote the Regulation; the European Commission proposes changes and adopts adequacy decisions and standard clauses. Each member state has one or more supervisory authorities, such as the CNIL in France and the Data Protection Commission in Ireland.

They investigate, order changes, suspend processing and fine; for a company with an EU main establishment, the authority where it sits leads cross-border cases (Article 56). The European Data Protection Board (EDPB), made up of those authorities, issues guidelines and settles disputes between them (Article 65).

Individuals can complain to an authority or sue for compensation (Articles 77 and 82).

There are no GDPR auditors the way there are SOC 2 auditors. Consultants and law firms help you build the file; they do not certify it. The only formal third-party check is voluntary certification by a body accredited under the Regulation (Article 43).

On cost: the Regulation carries no fee, registration or license; if you appoint a DPO, you publish the contact details and give them to the supervisory authority (Article 37(7)). Real cost is driven by the size of your data map, the vendor contracts to fix, whether you need a representative or a DPO, and whether data leaves the EU.

A simple business can do the core work in weeks; many data flows take months. No public body publishes a price, and we do not repeat vendor or consultant figures.

Sending data out of the EU, including to the United States

Personal data may leave the EEA only through one of three doors (Chapter V). First, an adequacy decision: the Commission has found sixteen countries and territories adequate, including the United Kingdom, Japan, South Korea, Brazil, and the United States for organizations that self-certify to the EU-US Data Privacy Framework (Article 45).

Second, appropriate safeguards, usually the Commission's standard contractual clauses (Decision 2021/914, in four modules by controller or processor role) or binding corporate rules for a group (Articles 46 and 47); the clauses come with a duty to assess whether the destination's law would stop the importer honoring them.

Third, one-off derogations such as explicit consent after a risk warning (Article 49).

Data a US company collects directly from people in the EU is not a transfer (EDPB Guidelines 05/2021); the transfer rules bite when an EU company, or your own EU office, sends you data. For those flows the choice is the Framework, run by the US Department of Commerce, or the clauses.

The Framework's adequacy decision of July 10, 2023 was challenged; the EU General Court dismissed the challenge on September 3, 2025 (Case T-553/23), and the claimant appealed to the Court of Justice on October 31, 2025 (Case C-703/25 P). The appeal was pending when we checked.

On July 31, 2026 the EDPB also asked the Commission to assess whether the US Supreme Court's June 29, 2026 ruling on the President's power to remove Federal Trade Commission commissioners affects the decision, which relied on the FTC's independence. The Framework is valid today; many companies keep the clauses ready as a fallback.

Enforcement and fines, as they actually happen

Fines sit in two tiers. Breaches of the controller and processor duties (records, contracts, security, impact assessments, DPOs, breach notification) carry up to 10 million euros or 2 percent of worldwide annual turnover, whichever is higher. Breaches of the principles, lawful bases, rights or transfer rules carry up to 20 million euros or 4 percent (Article 83).

Those are ceilings: the authority must weigh eleven listed factors such as intent or negligence, mitigation, cooperation and self-reporting (Article 83(2)), and the EDPB's method starts from a harmonized point and adjusts (Guidelines 04/2022). Orders to stop processing or suspend transfers often hurt more than the fine.

Two things the headlines hide. A fine needs intent or negligence, per the Court of Justice in 2023; in March 2026 Luxembourg's Administrative Court annulled the 746 million euro Amazon fine on that ground while upholding the finding that legitimate interests could not justify its behavioral advertising, and the regulator says the case continues.

And cross-border enforcement has been slow, so the EU adopted a regulation setting deadlines and common procedures, applying from April 2, 2027 (Regulation (EU) 2025/2518). To check a fine, go to the authority that imposed it, not a news list.

UK GDPR: a separate law with its own 2026 changes

The United Kingdom kept the Regulation after leaving the EU as "UK GDPR", alongside the Data Protection Act 2018, enforced by the Information Commissioner's Office (ICO), which becomes the Information Commission on September 30, 2026 and keeps the ICO name. The scope test has the same shape, so a US company serving both markets is covered twice.

The Data (Use and Access) Act 2025 received Royal Assent on June 19, 2025. Its data protection changes came in stages, the main ones on February 5, 2026, and the ICO confirmed on June 19, 2026 that all were in force.

For a small business: a new basis of "recognised legitimate interests" for listed purposes such as crime prevention, with no balancing test; named examples of ordinary legitimate interests (direct marketing, intra-group administration, network security); reasonable and proportionate searches for access requests, with the clock paused while you ask for clarification; wider room for solely automated decisions with safeguards, except with special category data; a duty to offer a complaints route and acknowledge within 30 days; some analytics cookies without consent; and electronic marketing penalties brought in line with UK GDPR.

The EU renewed its adequacy decision for the UK in December 2025, so EU data still flows to the UK.

What changed in 2025 and 2026, and what is only proposed

Adopted and covered above: the enforcement procedure regulation (applies April 2, 2027), the General Court's September 3, 2025 judgment on the Data Privacy Framework, the UK's 2025 Act changes, and the UK adequacy renewal of December 2025.

Proposed, not law. On November 19, 2025 the Commission published the Digital Omnibus proposal (COM(2025) 837).

As drafted it would clarify when pseudonymized data stops being personal data for a given holder; state that AI training can rely on legitimate interests; raise the breach notification threshold to "likely to result in a high risk" and extend the deadline from 72 to 96 hours; let controllers refuse access requests made for purposes other than protecting one's data; and move the cookie consent rule into the GDPR with low-risk purposes needing no consent.

Parliament's lead committees published a draft report on June 22, 2026, over 1,750 amendments followed, and the Council's June 26, 2026 vote on its mandate was canceled. Nothing in it changes what you must do today; the 96-hour breach window in particular is not law.

Under review. The Framework appeal (C-703/25 P) is pending, and the EDPB's July 31, 2026 letter asks the Commission to assess the effect of the US Supreme Court's FTC ruling.

What we could not verify

We could not open the Act or its commencement regulations on legislation.gov.uk from our tools (the site returned a challenge page), so the UK dates rest on the government's commencement plan and the ICO's pages.

We could not open the Court of Justice's case file to confirm whether a hearing in the appeal has been scheduled; the Official Journal notice confirms it was lodged on October 31, 2025 and we found no judgment. We did not verify member-state fees, DPO registration duties or each authority's list of processing that requires an impact assessment (Article 35(4)).