What is GDPR for US companies? (practical overview)

What is GDPR for US companies? The General Data Protection Regulation is EU privacy law that governs how organizations collect, use, store, and share personal data about people in the European Union. The consolidated text is Regulation (EU) 2016/679, published on EUR-Lex (https://eur-lex.europa.eu/eli/reg/2016/679/oj). It took effect on 25 May 2018 and applies across EU member states. US SaaS, ecommerce, and B2B teams often trigger it when they have EU customers, EU employees, EU website visitors, or EU marketing lists, even with no office in Europe.

GDPR is not an IT checkbox. It shows up in sales security reviews, marketing consent, analytics stacks, vendor contracts, and customer agreements. Product, marketing, sales, and legal need a shared map of data flows. This overview explains how privacy reality intersects with go-to-market. It is not legal advice. Counsel owns compliance posture. Our work is helping teams align GTM, product narratives, and security consulting with counsel's direction.

Territorial scope is where US teams get surprised. Article 3 of the regulation sets when GDPR applies outside the EU. In plain terms, obligations can attach when you process personal data in connection with offering goods or services to people in the EU, or when you monitor their behavior in the EU, regardless of where your company is incorporated. A Delaware SaaS company with EU sign-ups, EU trial users, or EU ad targeting may need counsel to assess scope even if every employee sits in the US. The European Commission maintains an English-language data protection hub for orientation (https://commission.europa.eu/law/law-topic/data-protection_en). Official pages are not your compliance program, but they beat guessing in a sales thread.

1. Inventory where EU personal data enters your product, marketing, support, and HR systems.
2. Map who is controller, who is processor, and which vendors touch the data.
3. Align privacy notices, contracts, and subprocessors with how you actually operate.
4. Prepare answers sales can send on hosting, access, retention, and breach process.
5. Review with counsel before you scale EU outreach or sign enterprise deals in Germany.

Personal data under GDPR is broader than many US teams expect. It covers information relating to an identified or identifiable natural person, names, email addresses, IP addresses in some contexts, device identifiers, location data, and more. Processing means almost any operation on that data: collection, storage, use, disclosure, deletion. If your app logs EU user behavior, your CRM holds EU contacts, or your support desk stores EU tickets, you are in processing territory. Counsel decides legal bases and retention. Your job is to know where the data lives and who touches it.

Controller and processor roles matter in contracts. A controller decides purposes and means of processing. A processor handles data on the controller's documented instructions, think hosting, email delivery, or analytics when you configure what gets sent. Article 28 requires specific terms when one organization processes personal data on behalf of another. US companies selling B2B software often act as processors for their customers' end-user data and as controllers for their own marketing and employee records. Both hats can exist at once. Mixing them up produces security questionnaires you cannot answer honestly.

GDPR vs CCPA is a common confusion point. The California Consumer Privacy Act (and its successor CPRA) is a US state privacy regime with its own definitions, rights, and business obligations. GDPR is EU law with different scope, legal bases, and enforcement paths. A US company selling globally may face both, plus other state laws. They are not interchangeable checklists. Legal counsel should map obligations by jurisdiction and by data category. Product and marketing should not treat "we did California" as "we did Europe."

Where GTM meets GDPR is where we spend time with clients. German and broader EU enterprise buyers often send security and privacy questionnaires early, sometimes before pricing conversations get serious. They ask about data location, subprocessors, encryption, access controls, retention, and incident response. They ask who signs the data processing agreement. They ask whether US transfers rely on approved mechanisms. Sales cannot invent those answers. A living document pack, aligned with counsel and your actual stack, keeps pipeline from dying in procurement.

Marketing and analytics deserve the same honesty as product. EU rules around consent, legitimate interest, and direct marketing differ from many US defaults. Tracking pixels, retargeting, purchased lists, and newsletter flows that work in the US can create friction in EU contexts. That is not a reason to panic. It is a reason to map flows before you scale spend into Germany. Pair privacy work with Germany market entry for US companies when GTM and compliance sequencing need to move together.

Transfers of personal data from the EU to the US have been heavily litigated and updated. The EU-US Data Privacy Framework is one mechanism US companies may use when eligible and when data flows qualify. Standard contractual clauses and binding corporate rules remain relevant in other scenarios. Transfer rules change with court decisions and administrative updates. Do not treat a blog post or a vendor badge as your transfer strategy. Counsel owns transfer posture. Engineering owns accurate data-flow diagrams so counsel can act on facts.

Enforcement is real but uneven. EU member state supervisory authorities can investigate, order changes, and impose fines. Public enforcement cases often involve large companies, but mid-market US vendors still feel pressure through enterprise customers who pass GDPR obligations downstream. A German buyer who cannot get a straight answer on subprocessors will choose a vendor who can. For many US B2B teams, customer diligence is the practical enforcement mechanism.

Documentation beats improvisation. Maintain a record of processing activities if you are required to. Keep vendor lists current. Version your privacy policy and cookie disclosures when the product changes. Train support on how to route data subject requests. None of that replaces counsel. It does prevent the weekly scramble when a prospect in Munich sends a forty-page questionnaire on Thursday afternoon.

Sensitive and health-related data raise the stakes. GDPR treats special categories of personal data under stricter rules in Article 9. Healthtech and medtech US companies selling into Germany should read Germany market entry for healthtech alongside this page and engage specialists early. We do not provide regulatory classification advice. We help align product narrative and security consulting with counsel's direction on cybersecurity & data privacy consulting.

A practical weekly habit: one owner publishes what changed in the product or stack that touches EU personal data. Legal reviews material changes. Sales gets updated one-pagers, not stale PDFs. That rhythm is boring. It is also how you avoid promising privacy controls in a demo that engineering never built.

Related pages for deeper context. Germany market entry: Germany and Germany market entry for US companies. Entity and readiness checklist: Germany entity & GTM checklist. Hands-on privacy and security consulting: cybersecurity & data privacy consulting. Use this glossary entry for orientation and vocabulary. Use counsel for binding decisions. Use consulting when GTM, product, and security need to tell the same story to German buyers.