Myth Buster: 'We’re Not in the EU, So GDPR Doesn’t Apply to Us'

The Myth

Many small business owners outside the European Union—from digital boutiques in New York to tech startups in Sydney—assume the GDPR is someone else’s problem. The reasoning sounds simple: “If my office isn’t on European soil, I don’t have to follow European laws.” That assumption is wrong and risky. Non-compliance can trigger regulatory investigations, complaints from EU residents, and even suspension by platforms you rely on (ads, analytics, payment, or marketplaces).

The Reality

Article 3 of the GDPR (territorial scope) makes activity—not location—the deciding factor. If you process the personal data of people in the EU, the GDPR applies. The UK has near-identical rules under the UK GDPR and the Data Protection Act 2018.

• Offering goods or services: You’re in scope even if no payment is required. Signals include pricing in euros, shipping or service availability to EU countries, EU-focused languages, or marketing aimed at EU audiences.
• Monitoring behavior: Tracking cookies, analytics, or profiling to observe or predict behavior of people in the EU for marketing or personalization brings you under the rules.

Enforcement is real. Clearview AI, a US company, was fined by French, Italian, and Greek regulators for unlawfully processing local residents’ data, despite having no offices there.

What This Means for You

Mere global accessibility of your site is not enough on its own. The GDPR applies when you intentionally target people in the EU/UK or monitor their behavior. If that describes you, take these steps:

• Decide your approach: Either serve EU/UK users and comply, or avoid targeting them. If you choose the latter, remove EU-targeting signals (euro pricing, EU shipping options, EU-specific ads) and technically restrict access where appropriate. This reduces—but does not automatically eliminate—risk.
• Appoint an EU/UK representative (Article 27): If you have no establishment in the EU/UK but are in scope, you must appoint a local representative (controllers and processors). The narrow exemption applies only if processing is occasional, low-risk, and not large-scale special-category/criminal data. Publish the representative’s contact details in your privacy notice.
• Map your data and flows: Identify what EU/UK personal data you collect, why, where it’s stored, and who you share it with. Maintain Records of Processing Activities (ROPA) under Article 30 if required; it’s good practice for all organizations.
• Set a lawful basis and update notices: Define a lawful basis for each purpose (e.g., contract, legitimate interests, consent) and update your privacy notice to meet Articles 13/14, including representative details, international transfers, retention, and user rights.
• Get consent right for cookies/trackers: In the EU/UK, do not place non-essential cookies or run behavioral ads until the user consents. Use a consent management platform that supports geolocation, granular choices, and records of consent. Ensure consent meets GDPR standards and EU ePrivacy rules.
• Vendor contracts and international transfers: Sign Data Processing Agreements with processors (Article 28). If EU/UK data is transferred to a country without an adequacy decision, put safeguards in place—typically Standard Contractual Clauses under Article 46 (plus a transfer impact assessment). For the UK, use the IDTA or the UK Addendum to the SCCs.
• Security and breaches: Implement appropriate security (Article 32) and a breach response process. Know the 72-hour supervisory-authority notification rule (Article 33) and, where applicable, communication to affected individuals (Article 34).
• Rights handling: Be ready to respond to access, deletion, and other rights requests within statutory timelines (Articles 15–22).

Bottom line: The GDPR isn’t about where your desk is—it’s about what you do with the personal data of people in the EU and the UK.