GDPR for International Businesses: When European Rules Apply to Companies Outside the EU

A company does not have to be registered in the European Union for the GDPR to apply to it. European rules may apply to a business from Georgia, Armenia, Serbia, the United Kingdom, the United States, or another country if it is connected with people located in the EU.

At the same time, the mere fact that a website is accessible from Europe does not mean that the company must comply with all GDPR requirements. To determine whether the Regulation applies, it is necessary to assess whether the business has an establishment in the EU, whether it offers goods or services to people in the European Union, and whether it monitors their behavior.

The main criteria for territorial scope are set out in Article 3 of the GDPR.

When the GDPR Applies to a Foreign Company

The Company Has an Establishment in the European Union

The GDPR applies if the processing of personal data is related to the activities of a representative office, branch, office, or other stable establishment of the company in the EU.

The legal form of the presence is not decisive. What matters is whether the company conducts real and stable activities within the European Union. For example, a local office, sales team, employees, or a division supporting operations in the European market may be relevant.

At the same time, the servers and the main team may be located outside the EU. If the processing of data is carried out in the context of the activities of the European establishment, the GDPR may still apply.

The Company Offers Goods or Services to Consumers in the EU

The GDPR applies to a foreign business if it intentionally offers goods or services to consumers located in the European Union. It does not matter whether they are paid or free of charge. It also does not matter whether actual sales have taken place in the EU; efforts aimed at attracting users from the EU may be sufficient.

An intention to work with a European audience may be indicated by:

• advertising targeted at specific EU countries;
• versions of the website in the languages of European countries;
• the ability to pay in euros or another local currency;
• delivery to European Union countries;
• references to European clients;
• separate pricing plans or terms for users from the EU;
• the use of a domain associated with an EU Member State.

None of these factors is conclusive evidence on its own. The company’s entire business model is assessed.

For example, if an online service from Armenia runs advertising in Germany, offers a German-language version of its interface, and accepts registrations from users in Germany, the GDPR will apply to the processing of their data.

The Company Monitors the Behavior of People in the EU

European rules may also apply if a foreign company collects information about the behavior of people located in the EU and that behavior takes place within the European Union.

Monitoring may include tracking activities on a website, building user profiles, analyzing interests, personalizing advertising, evaluating behavior, and predicting preferences. The mere use of an analytics tool does not always constitute monitoring within the meaning of the GDPR. It is necessary to consider what data is collected, whether it is linked to a specific user, and for what purposes the resulting information is used.

What Does Not, by Itself, Make the GDPR Applicable

The Website Is Accessible from EU Countries

The mere accessibility of a website to a European user is not sufficient. Otherwise, the GDPR would automatically apply to almost every international online resource.

There must be indications that the company targets people in the EU or monitors their behavior.

The Company Uses English

English is used in many countries and does not, by itself, demonstrate an intention to target the European Union market. The situation may be different if the business uses the language of a specific EU country together with local currency, advertising, and special terms.

The Database Contains Data of an EU Citizen

The GDPR does not protect only EU citizens. For the purposes of the criteria relating to the offering of services or monitoring, what matters is where the person is located at the relevant time, not which passport they hold.

Therefore, for example, if you operate a tourism business in Georgia, having the data of a French citizen who purchased a tour from you does not, by itself, make the GDPR applicable. Conversely, the GDPR protects a person who is not an EU citizen if that person is located within the European Union.

The GDPR also does not apply merely because you have had an incidental purchase by an EU resident. For example, you are a Serbian online store, you do not advertise your services in the EU, you have no language versions other than English, Serbian, and Russian, your prices are displayed in Serbian dinars and US dollars, and a resident of Poland purchases a product from you for delivery. In this case, the GDPR does not apply to you because you did not specifically target your activities at consumers in the EU.

How to Determine Whether a Company Targets the European Market

It is necessary to assess not only the website but the business’s entire activity. It is useful to check where users come from, which countries advertising is targeted at, which languages and currencies are available, whether contracts provide for working with European clients, and whether delivery or support is provided in the EU.

Let us consider several situations:

A service is available worldwide but is not promoted in the EU. The website has no localized versions, no payment options in European currencies, and no advertising targeted at EU countries. Mere technical accessibility is generally insufficient for the criterion of offering services to apply.

An online platform deliberately targets users from the EU. The company runs advertising in France and Spain, translates its interface, and accepts payments in euros. Such activities indicate an intention to offer services to people in the European Union.

A company uses data for behavioral advertising. Users in the EU are tracked across different pages, segmented, and then shown personalized advertising. Such processing may be considered monitoring of behavior.

A business works with European corporate clients. A contract with an EU company does not always mean that the GDPR directly applies to all activities of the foreign provider. However, the European client may transfer personal data of employees or users to the provider and require the execution of a DPA, compliance with security requirements, and lawful arrangements for international data transfers.

What Obligations Arise for the Company

If the GDPR applies, simply publishing a Privacy Policy is not enough. The company must establish an entire personal data processing framework.

First, it is necessary to determine what data is collected, where it comes from, for what purposes it is used, and to whom it is transferred. Then, a legal basis must be selected for each processing operation: contract, consent, legitimate interest, compliance with a legal obligation, or another basis provided for by the Regulation.

In addition, the company may need to:

• provide users with complete information about the processing;
• establish procedures for handling requests for access, rectification, and deletion of data;
• enter into DPAs with contractors and clients;
• review international transfers of personal data;
• maintain records of processing activities;
• implement technical and organizational security measures;
• establish procedures for responding to data breaches;
• conduct a DPIA for high-risk processing;
• appoint a Data Protection Officer (DPO) if the nature and scale of the activities require it.

The specific set of documents and procedures depends on the company’s role, the categories of data, the services used, and the risks to users.

When an EU Representative Is Required

A company that does not have an establishment in the EU but is subject to the GDPR because it offers goods or services or monitors behavior must generally appoint a representative in the European Union.

The representative serves as a contact point for users and European supervisory authorities. The representative must be established in one of the countries where the people whose data the company processes are located. An exemption may apply if the processing is occasional, does not include large-scale processing of sensitive data, and is unlikely to result in a risk to the rights and freedoms of individuals.

The representative should not be confused with a DPO. The representative facilitates communication between the company, users, and EU authorities, while the DPO oversees data protection matters within the organization. These are different functions, and in some cases a business may need both.

What an International Business Should Check

The first step is to answer four questions.

1. Does the company have a stable presence in the EU? It is necessary to consider not only registered branches but also the actual activities of local employees and business units.
2. Is the product targeted at people in the European Union? Advertising, languages, currencies, sales terms, and user geography should be analyzed.
3. Does the company monitor their behavior? Analytics, advertising tools, profiling, and personalization should be reviewed.
4. What role does the company perform when processing data? It may independently determine the purposes of processing, act on behalf of a client, or jointly make decisions with another business.

The answers make it possible to determine whether the GDPR applies, which documents are required, and whether an EU representative must be appointed.