October 14, 2026
GDPR applies to a US startup only if it offers goods or services to people in the EU or monitors their behavior there, not simply because its website can be reached from Europe. If it does apply, you need a lawful basis for each use of personal data, a clear privacy notice, data processing agreements with your vendors and customers, a way to answer access and deletion requests within a month, 72-hour breach notification and a lawful way to move data to the US. The UK has its own near-identical version. Fines can reach 4% of global revenue, but a startup’s first real GDPR test is usually an enterprise customer that won’t sign without a data processing agreement.
Key takeaways
It applies if you have an office or establishment in the EU, or, without one, if you offer goods or services to people in the EU or monitor their behavior there. Signs you’re offering to the EU include EU-language pages, pricing in euros, shipping to the EU, EU-targeted ads or marketing to EU customers. Monitoring includes tracking EU users’ behavior online, such as through behavioral advertising or analytics profiles.
Personal data is broad: anything that identifies a person directly or indirectly, including names, email addresses, IP addresses, device IDs, cookie identifiers and location data. Special categories, such as health, biometric, racial or ethnic origin, religious beliefs, sexual orientation and political views, carry stricter rules.
Often, yes. If you don’t market to the EU, don’t accept EU signups, don’t price in euros or ship there, and don’t track EU visitors, GDPR generally won’t apply just because someone in Europe can see your website. Many seed-stage startups deliberately limit signups to the US and other non-EU markets until they’re ready to comply. If you do this, make it real: block EU signups and EU ad targeting, and don’t send cold marketing to EU contacts.
GDPR lets you process personal data only if you have one of six legal grounds: consent, performance of a contract with the person, a legal obligation, protecting someone’s vital interests, a public task, or your legitimate interests where they aren’t outweighed by the person’s rights. Most startups rely on contract (to provide the service the user signed up for), legitimate interests (for things like security and some product analytics) and consent (for marketing emails and non-essential cookies). Pick and document a basis for each use, and say it in your privacy notice.
Consent must be freely given, specific, informed and unambiguous. No pre-checked boxes, no bundling it into your terms of service, and it must be as easy to withdraw as to give. For children, the default age for consent to online services is 16, though member states can lower it to as young as 13. In the US, children under 13 are covered separately by the Children’s Online Privacy Protection Act (COPPA).
For EU and UK visitors, yes, if you use non-essential cookies such as advertising or most analytics. A separate EU law (the ePrivacy Directive, implemented by each country) requires opt-in consent before setting them. That’s stricter than the US model, where most states only require an opt-out. Strictly necessary cookies, such as those that keep a user logged in, don’t need consent.
Yes. GDPR divides the world into controllers, which decide why and how personal data is used, and processors, which handle it on a controller’s behalf. Your startup is usually the controller of its own users’ data, and vendors such as your cloud host, payment processor, email platform, CRM and AI provider are your processors. If you sell software to businesses, you’re usually their processor for the data they put into your product.
A controller must have a written data processing agreement with each processor. Most large vendors include one in their terms, so collect and file them. Your business customers will ask you to sign theirs, or you can offer your own. Under Article 28, a DPA must cover:
See How Do I Draft a Strong Contract for My Startup?
A company with no EU establishment that is subject to GDPR generally must appoint a representative in the EU (and a separate one in the UK for UK GDPR). The exemption is narrow: processing must be occasional, must not include large-scale special-category data, and must be unlikely to put people at risk. A SaaS company with ongoing EU users usually doesn’t qualify for it. Representative services are widely available.
A data protection officer is required only if your core activities involve large-scale, regular and systematic monitoring of people or large-scale processing of special-category data. Most early-stage startups don’t need one, though someone on the team should own privacy.
You have one month to respond, extendable by two more months for complex or numerous requests if you tell the person within the first month. Verify the requester’s identity, then tell them what data you hold, why, where it came from, who you’ve shared it with and how long you’ll keep it, and give them a copy. For a deletion request, erase the data unless you have a lawful reason to keep it, such as a legal obligation. People can also ask you to correct data, restrict or object to processing, and receive their data in a portable format, and they can always object to direct marketing.
A common trap is cold outreach to EU contacts from a purchased lead list. If one of them asks where you got their data, you must tell them. Don’t email EU contacts from purchased lists without documenting a legitimate interests assessment, and stop if they object.
Notify the lead supervisory authority within 72 hours of becoming aware of a personal data breach unless it’s unlikely to put anyone at risk, and tell the affected people without undue delay if the risk is high. Document every breach, even ones you don’t report. See Data Breach Response for Startups.
GDPR restricts sending personal data outside the EU unless there’s a lawful transfer mechanism. The two that matter for US startups are:
The EU-US Data Privacy Framework. A US company can self-certify through the Department of Commerce and then receive EU data without further paperwork. The EU’s General Court upheld the framework in 2025, and an appeal is pending at the Court of Justice, which struck down the framework’s two predecessors. Check its status before relying on it alone.
Standard Contractual Clauses. These are EU-approved contract terms, usually built into your vendors’ DPAs, paired with a transfer impact assessment. Most large US cloud providers offer both the Framework and the clauses, so hosting EU data in the US is workable with the right paperwork.
Since Brexit, the UK has its own version of GDPR, enforced by the Information Commissioner’s Office. The rules are close to the EU’s, but you may need a separate UK representative, UK businesses processing personal data generally pay a fee to the ICO, and transfers to the US use the UK extension to the Data Privacy Framework or UK-specific transfer terms (the UK addendum to the EU clauses or the UK’s own international data transfer agreement).
Yes. If you hire someone who lives in the EU or UK, directly or through an employer of record, assume GDPR covers the personal data you hold about them, from payroll and benefits details to performance reviews and the logs your work tools keep, even if your company has no office there. A remote employee can be treated as an establishment, and the activity logs, email and device monitoring that come with most work tools can count as monitoring behavior in the EU, so plan as if GDPR applies even though the question isn’t fully settled.
Don’t rely on employee consent. Regulators assume employees can’t freely refuse their employer, so consent is rarely valid. Rely instead on the employment contract (to pay people and run the relationship), legal obligations (such as tax and social security records) and legitimate interests, and give each employee a short privacy notice explaining what you collect and why. If you use an employer of record, make sure your contract with it addresses data protection. If you rely on the Data Privacy Framework to move HR data to the US, your certification has to cover HR data specifically. A company with EU or UK employees but no establishment there may also need the representative described above.
Fines run up to €20 million or 4% of global annual revenue, whichever is higher, for the most serious violations, and up to €10 million or 2% for others, such as failing to report a breach. Those are ceilings. Regulators can also order you to stop processing or suspend transfers. For most startups, the more immediate consequence is commercial: EU and UK customers and enterprise buyers won’t sign without a DPA and a credible privacy program.
For the US side, see US Data Privacy Laws and Does My Startup Need a Privacy Policy? If you’d like help with a GDPR-ready privacy policy or a DPA, see our Terms of Service & Privacy Policy service or contact us.
