ShareAndGoShareAndGo

Privacy

GDPR for US businesses: when European privacy rules reach an American company.

Plenty of American companies assume the General Data Protection Regulation is a European problem. Then a customer in Germany asks for a data processing agreement, a prospective acquirer asks how EU personal data is handled, or a French employee asks to see what records the company keeps about them.

This article explains, in general terms, when the GDPR can apply to a business based in the United States, the main obligations it brings, and where document sharing fits. It is an overview, not legal advice. Whether and how the regulation applies to your company is a question for an attorney who practices in European data protection.

Why a US company can fall within its reach

The GDPR is a European Union regulation, but its territorial scope, set out in Article 3, is not limited to companies with offices in Europe. Broadly, it can apply to an organization outside the EU when that organization offers goods or services to people who are in the EU, or monitors their behavior there.

That second limb catches more businesses than people expect. Tracking how visitors from Europe use a website, profiling them for advertising, or analyzing their behavior inside an app can all be forms of monitoring. Offering goods or services is judged by intent and context: a site that takes euros, ships to Paris and has a page in Italian is plainly aimed at Europeans, while a site that simply happens to be reachable from Europe may not be.

A US company can also come within the regulation because it has an establishment in the EU, such as a subsidiary, a branch or staff on the ground, and processes personal data in the context of that establishment's activities.

Controllers and processors

The GDPR distinguishes between a controller, which decides why and how personal data is processed, and a processor, which handles personal data on a controller's behalf. Many US service providers are processors for European clients, and those clients are required to put a written contract in place that sets out the processor's obligations. That is why a European customer's request for a data processing agreement is often the first time an American vendor meets the regulation.

The main obligations in brief

The regulation is long and detailed. At a high level, these are the themes that come up most often for American businesses that fall within it.

  • A lawful basis for each kind of processing, such as consent, performance of a contract or legitimate interests.
  • Transparency: telling people what data you collect, why, how long you keep it and who receives it.
  • Rights for individuals, including access to their data, correction, deletion in some circumstances and objection to some uses.
  • Security appropriate to the risk, which the regulation leaves to the organization to judge and document.
  • Notifying the relevant supervisory authority of a personal data breach, generally within 72 hours of becoming aware of it, and in some cases telling the affected people.
  • Records of processing activities, and for some organizations a data protection officer.
  • Rules on sending personal data out of the European Economic Area.

A company outside the EU that is caught by Article 3(2) is generally expected to appoint a representative in the EU, subject to limited exceptions. Fines for serious breaches can reach up to four percent of worldwide annual turnover, which is one reason European counterparties take the questions seriously.

Transfers from Europe to the United States

Moving personal data from the EU to another country is restricted unless certain safeguards exist. For the United States, the European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework in July 2023. American organizations that self-certify to the Framework through the Department of Commerce can receive personal data from the EU on that basis. Others commonly rely on the Commission's standard contractual clauses.

Transfer rules have changed more than once over the past decade, and they are a common subject of questions in vendor reviews. If European data flows through your business, ask counsel which mechanism you rely on and keep that answer written down where your team can find it.

Where document sharing fits

Many of the documents a business shares during a deal, an audit or a dispute contain personal data: employee lists, payroll files, customer records, contracts signed by individuals. When some of those people are in Europe, the way you share those files becomes part of how you meet the security and transparency themes above.

A few practical habits help regardless of which law applies.

  1. Share only what the recipient needs. A buyer evaluating headcount may need role and salary bands, not home addresses.
  2. Limit access to named people rather than forwarding links that anyone holding them can open.
  3. Keep a record of who saw which document and when, so you can answer questions later.
  4. Set an end date on access and remove documents once the purpose is complete.

ShareAndGo is built around those habits. Each recipient confirms their own email address with a six-digit code, so access belongs to a person. Groups decide which folders each audience can see. View-only access shows PDFs, Word, Excel and PowerPoint files as watermarked renders without sending the original file to the viewer's browser. Invitations can expire and be revoked, and an audit log records every view, upload, download and change, with an export to CSV.

None of that settles your GDPR position on its own. It gives you control over and a record of document sharing, which are things your counsel is likely to ask about.

A sensible way to start

If you are unsure whether the GDPR applies, begin with an inventory. List where personal data about people in Europe enters your business, which systems hold it, who can see it, and which vendors process it for you. That inventory is useful for US state privacy laws too, several of which ask similar questions.

Then take the inventory to an attorney. A short, well-organized summary makes that conversation faster and helps them give advice that fits your actual operations.

Common questions

Does having a website visitors in Europe can reach mean the GDPR applies?
Not by itself. The question is generally whether you offer goods or services to people in the EU or monitor their behavior there. An attorney can look at your specific facts.
Is the GDPR the same as US state privacy laws?
No. They share some ideas, such as rights to access and delete data, but the scope, definitions and obligations differ. Treat them as separate questions.
Can ShareAndGo help with a data subject access request?
Search reads the text inside documents, including scans, so it can help you find files that mention a person. Deciding what to disclose is a judgment for you and your advisors.

Read next

State privacy laws and document sharing

How US state privacy laws bear on the files you send.

Data sharing agreement clauses

Terms worth reading before you hand over personal data.

Where your data lives

Questions to ask any vendor about where files are kept.