GDPR Compliance Checklist for US Companies Serving EU Customers
GDPR Compliance Checklist doesn’t care where your servers sit or where your company is incorporated. If a US business offers goods or services to people in the EU, or tracks their behavior online, the regulation applies — full stop. Most American founders learn this only after a European customer signs up, a cookie banner gets flagged, or a vendor questionnaire asks for a GDPR compliance statement they don’t have.
This guide walks through who actually needs to comply, the six-step checklist that gets a US company to a defensible GDPR posture, what changed in the international data-transfer landscape as of mid-2026, and what enforcement actually looks like when compliance is missing.
�� Quick Answer GDPR Compliance Checklist applies to any US company that offers goods or services to people in the EU/EEA, or monitors their online behavior — regardless of where the company is based (Article 3(2)). Compliance means having a lawful basis for processing, transparent privacy notices, a working process for data subject rights, 72-hour breach notification, and a valid mechanism for transferring EU data to US servers. As of July 2026, that last requirement is unusually unstable: a June 2026 US Supreme Court ruling has put the primary transfer mechanism most US companies rely on under direct legal challenge.
Does GDPR Compliance Checklist Even Apply to Your Company?
GDPR Compliance Checklist extraterritorial reach comes from Article 3(2), and it doesn’t require a US company to have any physical presence in the EU. Two independent tests decide it: whether you offer goods or services to people in the EU (paid or free), and whether you monitor their behavior — including through cookies, analytics, or ad-tracking pixels.
| Likely Triggers GDPR | Likely Does NOT Trigger GDPR |
|---|---|
| Website lets EU visitors pay in euros or select an EU country at checkout | A US-only site that an EU visitor stumbles onto without any EU-specific targeting |
| Marketing materials mention EU countries or use EU languages | Occasional, unsolicited orders from EU customers with no active marketing to them |
| Google Analytics, Meta Pixel, or similar tools track EU visitors | A B2B tool used only by US-based employees, with no EU data subjects involved |
| SaaS product has EU-based users, even on a free tier | A vendor with no access to personal data (pure infrastructure, no PII exposure) |
| Company has an EU subsidiary, office, or other establishment | Static marketing content with no data collection of any kind |
| EU shipping options or EU-specific pricing are offered | Content blocked or geo-fenced from EU IP ranges entirely |
How EU-US Data Transfer Law Got to This Point
Every US company handling EU personal data eventually runs into the same question: what legal mechanism allows that data to move from the EU to US servers at all? The answer has changed three times in twenty-five years, and it may be about to change again.
Safe Harbor and Privacy Shield were both struck down by the Court of Justice of the EU over concerns that US surveillance law couldn’t guarantee EU-equivalent protection. The current framework, the EU-US Data Privacy Framework (DPF), was adopted in July 2023 and has since been self-certified by more than 5,300 US organizations. It survived an initial legal challenge in EU courts in September 2025. But its foundation depends on the FTC functioning as an independent enforcement authority — and that assumption came under direct legal pressure in June 2026.
The 6-Step GDPR Compliance Checklist
Regardless of company size, the path to a defensible GDPR Compliance Checklist posture follows the same six stages. Skipping straight to a privacy policy update without the earlier steps is the single most common reason compliance programs don’t hold up under scrutiny.
Map your EU personal data flows: identify every place EU personal data enters your systems — signup forms, cookies, support tickets, payment processors — and where it goes from there, including any subprocessors.Establish a lawful basis for processing: every use of personal data needs one of six legal bases under Article 6 (consent, contract, legal obligation, vital interests, public task, or legitimate interest) — documented, not assumed.
Rewrite privacy notices for GDPR transparency: Articles 13-14 require plain-language disclosure of what you collect, why, how long you keep it, and who it’s shared with — generic US-style privacy policies typically fall short.
Build a data subject rights process: EU individuals can request access, correction, deletion, portability, or object to processing — you need a real, timely workflow to handle these, not just a policy that mentions them.
Implement security safeguards and breach notification: technical and organizational measures (encryption, access controls, pseudonymization) are expected as a baseline, and any breach must be reported to regulators within 72 hours.
Choose a valid international transfer mechanism: DPF self-certification is the most common route for US companies, but given its current legal exposure, pairing it with Standard Contractual Clauses (SCCs) and a Transfer Impact Assessment is now the more defensible position.
Do You Need a Data Protection Officer or an EU Representative?
These are two separate, commonly confused obligations. A DPO oversees your data protection compliance internally; an EU representative is a local point of contact for regulators and EU data subjects
| Requirement | When It Applies | What to Do |
|---|---|---|
| Data Protection Officer (DPO) | Large-scale systematic monitoring is your core activity, or you process special-category data at scale | Appoint an internal or external DPO with independent reporting authority — even if not required, one strengthens your posture |
| EU Representative (Article 27) | You have no EU establishment and process EU personal data beyond occasional, low-risk activity | Appoint an individual or firm based in an EU member state where your data subjects are located |
| Neither required | Processing is occasional, doesn't involve special-category data at scale, and carries low risk to individuals | Document the assessment anyway — regulators expect you to show your reasoning, not just your conclusion |
�� Common Trap – Assuming that signing up for the EU-US Data Privacy Framework is a one-time task that permanently solves your transfer problem. It doesn’t. DPF certification requires annual re-certification, applies only to the specific data flows you declared, and — as of mid-2026 — sits on legal ground that European regulators and privacy advocates are actively challenging. Treat it as one layer of a defense, not the whole defense.
�� Common Trap – Assuming that signing up for the EU-US Data Privacy Framework is a one-time task that permanently solves your transfer problem. It doesn’t. DPF certification requires annual re-certification, applies only to the specific data flows you declared, and — as of mid-2026 — sits on legal ground that European regulators and privacy advocates are actively challenging. Treat it as one layer of a defense, not the whole defense.
The 2026 Update: Why the DPF's Legal Ground Just Shifted
On June 29, 2026, the US Supreme Court ruled in Trump v. Slaughter that statutory protections shielding Federal Trade Commission commissioners from at-will presidential removal are unconstitutional. That ruling had nothing to do with privacy law on its face — but the DPF’s adequacy decision leans on the FTC’s independence as one of its core legal justifications, since EU law requires that data protection oversight come from a genuinely independent authority.
Within a day of the ruling, the Austrian privacy group noyb, led by Max Schrems, sent a letter to the European Commission arguing that the FTC can no longer be considered independent under the Court’s new reasoning, and called for the Commission to begin unwinding the DPF’s adequacy decision. The European Commission has not withdrawn adequacy as of this writing, and a separate legal challenge to the DPF (sometimes called “Schrems III”) was already working through the EU court system before this ruling, with a CJEU opinion expected in late 2026 or early 2027. But the practical risk for US companies relying solely on DPF certification is now higher than it has been at any point since the framework’s 2023 adoption.
The organizations best positioned if the DPF is narrowed or annulled are the ones that never treated it as their only transfer mechanism. Pairing DPF certification with Standard Contractual Clauses, documented Transfer Impact Assessments, and real technical safeguards means a future adverse ruling changes paperwork, not operations.
What Happens If You Don't Comply
GDPR fines scale with the severity of the violation, not company size alone, and enforcement has accelerated sharply. Cumulative fines since 2018 now exceed €7.1 billion across more than 2,600 documented enforcement actions, with roughly €1.2 billion issued in 2025 alone. European authorities now receive over 440 breach notifications per day, up 22% year over year.
| Tier | Maximum Penalty | Typical Trigger |
|---|---|---|
| Tier 1 — Procedural | €10 million or 2% of global annual turnover, whichever is higher | Missing records of processing, inadequate DPIAs, failure to appoint a required DPO or representative |
| Tier 2 — Substantive | €20 million or 4% of global annual turnover, whichever is higher | Unlawful processing, invalid consent, ignoring data subject rights, unlawful international transfers |
Eight of the ten largest GDPR fines on record have hit US-based companies, and the pattern behind them is consistent: data collected beyond what users realized, held longer than necessary, or transferred without a valid legal basis. Company size doesn’t provide cover — Article 83’s percentage-of-revenue cap means the largest exposure often lands on the companies with the most global revenue to lose.
Common GDPR Mistakes US Companies Make
| Mistake | What It Looks Like |
|---|---|
| Treating a US privacy policy as GDPR-compliant | Reusing CCPA-style disclosures without adding the specific transparency elements Articles 13-14 require. |
| Assuming DPF certification is permanent | Not re-certifying annually, or not updating the certification when new data flows or vendors are added. |
| No real process behind data subject rights | Publishing a policy that mentions access/deletion rights with no actual internal workflow to fulfill requests within the required timeframe. |
| Ignoring cookie and tracking consent rules | Running EU-facing analytics or ad pixels on pre-checked consent or implied consent through browsing. |
| Skipping the EU representative requirement | Assuming that having no EU office means no EU-facing obligations at all. |
| No documented lawful basis per processing activity | Relying on "consent" as a blanket justification without mapping which basis applies to which specific use of data. |
Competitor Content Analysis
A look at what’s currently ranking for “gdpr compliance checklist” and “gdpr compliance checklist for us companies” shows a field dominated by cookie-consent vendors, GRC platforms, and law-firm PDFs.
- GDPR.eu is the default reference: its general checklist and US-specific companion page rank consistently and are treated as a baseline citation across the space, but both were last substantively updated years ago and don’t reflect the 2026 transfer-mechanism instability.
- Cookie-consent vendors lead with narrow framing: sites like Cookiebot and CookieYes rank well but pull the conversation toward consent banners specifically, underserving readers who need the fuller compliance picture.
- Compliance-automation platforms (Vanta, ZenGRC, Legit Security) front-load education, then pivot to product: useful regulatory grounding, but the checklist itself is often secondary to a demo request.
- Almost nothing currently live reflects the June 2026 Trump v. Slaughter fallout: most competing GDPR-for-US-companies content predates or ignores the FTC independence challenge to the DPF — a substantial and very recent accuracy gap.
- Fine statistics vary widely by publish date: several pages still cite 2023-era cumulative fine totals; citing the current €7.1B+ figure with a date is a small but meaningful edge.
- Few pages clearly separate the DPO and EU Representative requirements: these two obligations are frequently conflated, even though they trigger under different conditions and require different actions.
Search Intent: What People Are Actually Asking
Short notes on the intent behind this topic and its related searches, based on how the query is typically phrased:
- “Does GDPR apply to my company” is the dominant entry query: most US searchers start by trying to determine applicability before looking for compliance steps — the Article 3 test needs to come early in any ranking content.
- “GDPR checklist for small business/startup/SaaS” signals company-size anxiety: searchers frequently want reassurance that GDPR compliance is achievable without an enterprise legal budget.
- Transfer-mechanism queries are rising fast: “is privacy shield still valid,” “dpf vs scc,” and similar searches reflect real confusion left over from two prior framework invalidations.
- “GDPR fine calculator” and penalty-amount searches trail closely behind: a meaningful share of searchers are assessing risk exposure, not just planning a compliance program.
- Comparison queries cluster around US state laws: “gdpr vs ccpa” remains one of the highest-volume related searches, since many US companies are managing both simultaneously.
AI Overview
If this topic were condensed into an AI-generated search summary, it would likely read: GDPR Compliance Checklist applies to any company worldwide, including US businesses, that offers goods or services to people in the EU/EEA or monitors their online behavior, regardless of where the company is based. Compliance requires a documented lawful basis for processing, GDPR-compliant privacy notices, a working process for data subject rights, security safeguards with 72-hour breach notification, and a valid mechanism for transferring EU personal data internationally. Most US companies rely on the EU-US Data Privacy Framework for that last requirement, but a June 2026 US Supreme Court ruling on FTC independence has placed the framework’s legal foundation under renewed challenge, making a layered approach — DPF plus Standard Contractual Clauses plus documented risk assessments — the more resilient strategy heading into 2027. Non-compliance penalties reach €20 million or 4% of global annual turnover, whichever is higher.
�� Worth Remembering An AI overview or quick search answer will tell a reader that GDPR Compliance Checklist applies and that fines are large — but it won’t tell them whether their own specific data flows, vendor stack, and transfer mechanism would actually hold up if a regulator asked. That gap between general awareness and an audit-ready program is where most real compliance work — and most real risk — actually lives.
A Practical GDPR Management Checklist
- Maintain a live record of processing activities covering every system that touches EU personal data.
- Re-verify your lawful basis whenever you launch a new feature, campaign, or data use case.
- Review privacy notices annually against current EDPB transparency guidance, not just at initial launch.
- Test your data subject rights workflow end-to-end at least once a year, not just on paper.
- Track DPF re-certification deadlines and pair certification with SCCs for any EU-US transfer.
- Revisit your Transfer Impact Assessment whenever the DPF’s legal status changes materially.
- Include GDPR posture as a standing item in vendor and subprocessor risk reviews.
How B4Q Assurance Helps
B4Q Assurance helps US companies map their EU data flows, build a defensible lawful-basis and consent framework, and design a layered international transfer strategy that doesn’t depend on any single legal mechanism holding up — so a future DPF ruling changes documentation, not operations.
Related Resources
FAQs
Does GDPR apply to a US company with no EU office?
Yes, if the company offers goods or services to people in the EU or monitors their behavior online. Physical presence in the EU is not required for GDPR to apply — Article 3(2) is based on whose data you process, not where you’re incorporated.
Is the EU-US Data Privacy Framework still valid?
Yes, as of this writing the DPF remains in effect and the European Commission has not withdrawn its adequacy decision. However, a June 2026 US Supreme Court ruling has raised serious legal questions about the framework’s foundation, and a separate court challenge is pending before the CJEU. Companies should not treat it as a permanent, uncontested legal basis.
Do we need a Data Protection Officer?
Only if large-scale systematic monitoring is a core part of your business, or you process special categories of sensitive data at scale. Many US companies don’t strictly need one but appoint one anyway to strengthen their compliance posture.
What's the difference between a DPO and an EU Representative?
A DPO oversees your organization’s data protection compliance internally. An EU Representative is a local point of contact based in the EU that regulators and data subjects can reach — required for companies with no EU establishment that process EU data beyond occasional, low-risk activity.
How much can a GDPR violation actually cost?
Fines fall into two tiers: up to €10 million or 2% of global annual turnover for procedural violations, and up to €20 million or 4% of global annual turnover for substantive breaches like unlawful processing or invalid international transfers — whichever amount is higher in each case.