Yes, it can. GDPR Article 3 applies to a business outside the EU when it processes personal data of people in the EU and the processing relates to offering them goods or services, or to monitoring their behaviour as far as it takes place in the EU. Having no office in Europe does not settle the question.
The two triggers
For controllers and processors not established in the Union, Article 3(2) applies where the processing relates to:
- Offering goods or services to people in the Union, whether or not payment is required.
- Monitoring their behaviour, to the extent the behaviour takes place within the Union.
Article 3(1) separately covers any processing in the context of the activities of an EU establishment, wherever the processing physically happens. Article 3(3) covers some cases where Member State law applies under public international law.
Signals that point to "offering"
The article itself does not list signals. The recitals discuss them, and the European Data Protection Board has guidance. This post names plausible points to review rather than quoting them:
- Pricing in euros or another EU currency.
- Languages that serve EU markets.
- Marketing aimed at EU countries.
- Delivery or support commitments to EU addresses.
Merely being reachable from a website is not usually enough on its own, but combine several signals and the risk rises. Ask counsel to apply the recitals to your facts.
Signals that point to "monitoring"
Tracking the behaviour of people in the EU, for example profiling their browsing for advertising or analytics, is the typical case. A US analytics tool embedded on a site with EU visitors can bring both the site owner and the tool vendor into scope.
What follows if it applies
You take on the same duties as an EU company:
- A lawful basis for each purpose, and a privacy notice.
- Honouring individual rights within a month.
- Security and breach handling, including the 72 hour regulator notice.
- Processor contracts.
- Records of processing, subject to the small organisation exemption.
The text also contemplates a representative in the Union for some non-EU controllers. The details sit in Article 27, which this post did not review.
A short scoping exercise
- List your products and where customers and users are.
- Mark which ones target the EU on purpose.
- List tracking and analytics tools that profile EU visitors.
- Decide, and write down why. Revisit when you launch a new market.
Quick check
We are a US B2B SaaS with a few EU users. Are we in scope?
Possibly. If you offer your service to people in the EU, the first trigger can apply. Get advice on your facts.
Does it matter where our servers are?
Article 3(2) turns on whose data is processed and why, not on where servers sit.
Sources
Last reviewed: 19 October 2026.
