GDPR applies to a US small business when it offers goods or services to people in the EU or EEA, or monitors their behavior there. Company size does not exempt you, and neither does being based in California. If you sell to Europeans, run EU-targeted marketing, or hold European customers' data, you need a documented way to handle that data. If you have no real European footprint, GDPR most likely does not apply to you.
This guide explains how to tell which group you are in, what the regulation asks of a small organization, and how to turn it into a working program. It also covers the parts that tend to fall on IT: security controls, vendors, breach response and data transfers.
TL;DR
- GDPR applies to US businesses that offer goods or services to people in the EU/EEA or monitor their behavior. A website that Europeans can merely open is not enough on its own.
- Small size is not an exemption. Obligations are proportionate to risk, but lawful basis, security, individual rights and breach duties still apply.
- Start with a data map, a privacy notice, vendor agreements, retention rules and a written breach process.
- The maximum fine is up to €20 million or 4% of worldwide annual turnover, whichever is higher. That is a ceiling, not an automatic penalty for small firms.
- If you do not serve the EU, your more immediate obligations are likely California's privacy and breach laws.
Table of Contents
- Does GDPR apply to a US small business?
- Why size does not exempt you, and what proportionality means
- The core requirements in plain terms
- What you cannot do under GDPR
- A GDPR requirements checklist for small businesses
- Security is where IT and compliance meet
- Vendors, processors and cloud tools
- Transferring EU data to the United States
- Breach response: the 72-hour rule
- Our perspective: GDPR is a data and security project
- What if you do not serve the EU?
- How Secure Techies can help
- FAQ
- Sources
Does GDPR apply to a US small business?
The test is targeting, not geography. According to the U.S. International Trade Administration, a US company may need to comply when it offers goods or services to people in the EU/EEA or monitors their behavior there. The same guidance notes that GDPR applies regardless of business size once those territorial criteria are met.
The European Commission's business portal says the regulation covers European organizations processing the data of people in the EU, and also organizations outside the EU that target them.
Signs you are targeting the EU
Regulators and lawyers look for evidence of intent. Indicators can include:
- Marketing in European languages
- Prices in euros or payment in euros
- European phone numbers or addresses on your site
- Europe-specific domains, such as a .de or .fr site
- Shipping or service offers aimed at EU countries
- Advertising campaigns or tracking tools aimed at people located in Europe
Situations that usually do not trigger GDPR
Law firm commentary on US companies points out that intent is the key question. A European national living in the US, an EU resident visiting your California office, or an employee traveling in Europe is not automatically enough. Nor is a website that happens to be reachable from Europe.
When the picture is mixed, such as a few European subscribers or a European distributor, have a privacy attorney review your facts. This is a legal determination, and an IT provider cannot make it for you.
Why size does not exempt you, and what proportionality means
The European Data Protection Board (EDPB) states that SMEs whose core business is not processing personal data may have less extensive obligations than larger or high-risk organizations, but they must still meet the requirements that apply to them.
In practice:
- A small online shop holding ordinary customer contact details is assessed very differently from a company whose core activity is large-scale behavioral tracking or sensitive health data.
- Proportionality changes the scale of your controls. It does not remove the need to understand your data, your legal basis, your security, your retention and your rights procedures.
- GDPR contains a limited record-keeping relief for organizations with fewer than 250 employees. It does not remove the other duties, and the relief has conditions, so do not assume it covers you.
The core requirements in plain terms
People search for "the 7 GDPR requirements." The regulation does not publish a list with that name. What small businesses are usually looking for is the set of principles in Article 5 plus accountability, as summarized by the EDPB's data protection basics:
| Principle | What it means for your business |
|---|---|
| Lawfulness, fairness, transparency | Have a valid legal basis and tell people clearly what you do with their data |
| Purpose limitation | Collect data for stated purposes and do not reuse it for unrelated ones |
| Data minimization | Collect only what you need |
| Accuracy | Keep data correct and fix errors |
| Storage limitation | Delete or anonymize data when you no longer need it |
| Integrity and confidentiality | Secure data with appropriate technical and organizational measures |
| Accountability | Be able to demonstrate that you comply |
Legal basis: consent is not the default
Before you collect or use personal data you need a legal basis: consent, contract necessity, legal obligation, vital interests, public task, or legitimate interests where the individual's rights do not override yours. Consent is only one of these.
Where you do rely on it, the EDPB says valid consent must be freely given, specific, informed and unambiguous. Pre-ticked boxes and silence do not qualify. Using consent for processing that is actually necessary to deliver a contract is a design mistake, because people can withdraw consent while you still need the data to fulfill the order.
What you cannot do under GDPR
The regulation is mostly about how you handle data, not a list of banned activities. In practice, businesses get into trouble when they:
- Collect data with no stated purpose or legal basis
- Use pre-ticked boxes or bundled consent
- Keep personal data indefinitely "just in case"
- Ignore access, correction or deletion requests
- Share data with vendors that have no data processing agreement
- Fail to document a breach, even a minor one
- Move data out of the EU/EEA without a valid transfer mechanism
A GDPR requirements checklist for small businesses
The EDPB's small business guidance describes a practical program built from the elements below. Treat these as workflows that run in your systems, not statements in a policy document.
- Build a data map. For every collection point, record the purpose, lawful basis, system, vendor, retention period, who has access, how deletion works and whether data leaves the EU/EEA. This is the single most useful document, and a privacy notice alone cannot fix gaps it reveals.
- Publish a privacy notice. Say who you are, what you collect, why, on what basis, who receives it, how long you keep it and how people exercise their rights.
- Set retention and deletion rules. Give each data category a retention period and a secure deletion path, including in backups.
- Create a request procedure. Decide who receives access, correction and deletion requests, how you verify identity, where you search, and how you respond on time.
- Sign data processing agreements. Every vendor that handles personal data for you (email, CRM, payroll, cloud storage, marketing platforms) needs a contract that sets out its obligations.
- Apply security controls. Use multi-factor authentication, encryption, patching, access limits and endpoint protection suited to the risk.
- Document transfer safeguards. If EU/EEA data moves to the US, record which mechanism covers it.
- Train your staff. People who handle customer data should know how to spot a request or an incident.
- Write a breach response plan. Do it before you need it. More on this below.
- Review it regularly. Update the data map when you add a tool, a vendor or a marketing channel.
Security is where IT and compliance meet
GDPR asks for "appropriate" security, which means it should match the risk. For most small businesses that translates into the same baseline any good security program uses: MFA on email and admin accounts, patched devices, endpoint detection, tested backups, least-privilege access and logging. If you have not reviewed yours recently, our small business cybersecurity checklist is a good place to start.
Security also has to be provable. Under the accountability principle, you need records showing which controls exist and when you last checked them. For a team without in-house IT, that is often the hardest part.
Vendors, processors and cloud tools
Most small businesses hold personal data in tools run by someone else. Under GDPR you remain responsible for choosing processors that give adequate guarantees. A short vendor review should cover:
- What personal data the vendor touches
- Where the data is stored and who can access it
- Which subcontractors the vendor uses
- Its security practices and breach notification commitments
- How it returns or deletes data when the contract ends
For a structure to follow, see our guide to vendor risk management for small business. A framework for reviewing vendors, processors and subcontractors can also help you decide which questions to ask when AI features or managed service providers sit in the chain. For cloud environments in particular, our cloud infrastructure data compliance guide covers configuration and data location issues.
Transferring EU data to the United States
If you receive personal data from the EU/EEA, GDPR's Chapter V requires a transfer mechanism. Two common ones are the EU-U.S. Data Privacy Framework, where the US recipient holds an active, relevant self-certification, and Standard Contractual Clauses where appropriate. The Data Privacy Framework program is administered by the US Department of Commerce. Participation is voluntary, but commitments become enforceable under US law once an organization self-certifies.
Three points matter for small businesses:
- A Framework listing is not a blanket GDPR certification. The EDPB's FAQ for businesses explains that the listing must be active and cover the relevant type of data, and it is maintained through annual recertification.
- A transfer mechanism solves only one part of the problem. You still need a lawful basis, transparency, security, processor contracts and a way to honor individual rights.
- The framework has faced legal challenge. In September 2025 the EU General Court confirmed the adequacy decision in the Latombe case. Because the legal position can change, record a fallback mechanism and check current status when you sign or renew contracts.
If your marketing team collects European data, privacy-first marketing practices show how to handle tracking, consent and data collection in a way that holds up.
Breach response: the 72-hour rule
Under the EDPB's guidance on data breaches for small businesses, a controller must document every personal data breach, even when notification is not required. A breach that creates a risk to individuals generally must be reported to the relevant supervisory authority within 72 hours of becoming aware of it. A high-risk breach must also be communicated to the affected individuals without undue delay. Processors must notify the controller without undue delay.
The 72 hours is short, so prepare ahead:
- Name who decides whether an incident involves personal data.
- Keep a contact list for your IT provider, your attorney and your cyber insurer.
- Log each incident: what happened, which data, how many people, what you did.
- Keep a template for notifying authorities and individuals.
- Test the plan at least once a year with a tabletop exercise.
If you have California customers, state law adds its own clock. Our guide to the California data breach law explains those timelines. A security program built around detecting and reporting breaches is what makes any of these deadlines achievable.
Our perspective: GDPR is a data and security project
We work with small and mid-size organizations in Southern California, many of them in healthcare, legal and financial services. Most come to us about HIPAA, SEC or CMMC. When GDPR comes up, it is usually because a client signed a European customer, hired a European contractor or started running campaigns abroad.
Our experience is that the legal text is rarely what stops a small business. The obstacle is that nobody can say where personal data lives. Email, shared drives, a CRM, a billing system and a few forgotten SaaS accounts all hold it, and no one owns the list.
That is why we start with inventory and security, not policy drafting. Once you know your systems, vendors and access, a privacy notice and a request procedure are straightforward. Without that, they are guesses. We also prefer preventative work: monitored endpoints, tested backups and a rehearsed incident plan cost far less than improvising on day one of a breach.
One caution: we deal with the technical and operational side. Whether GDPR applies to your specific facts, and which legal basis fits a given activity, are questions for a privacy attorney.
— Alex
What if you do not serve the EU?
Then your priorities are probably closer to home. California businesses that meet the thresholds face the CCPA and CPRA, and regulated sectors have their own rules. Our CCPA and CPRA compliance guide covers the California side. Financial firms should look at GLBA requirements. Many of the controls overlap, so work done for one framework usually helps with the others.
How Secure Techies can help
We help small and mid-size businesses turn privacy obligations into systems that run. Our compliance and security audits cover frameworks including HIPAA, GDPR, SEC, SOC 2 and CMMC, and our managed cybersecurity includes endpoint detection, incident response and risk assessment. If you want one team to monitor, secure and document your environment, see managed IT services.
FAQ
Does GDPR apply to US companies?
Yes, when a US company offers goods or services to people in the EU/EEA or monitors their behavior there. Being based in the US does not matter. Evidence of intentional targeting, such as euro pricing or European-language marketing, is what counts.
Do I need to be GDPR compliant as a small business?
Only if the territorial test is met, and then size does not exempt you. Smaller organizations processing low-risk data face proportionate obligations, but the core principles, rights, security and breach duties still apply. Ask a privacy attorney to confirm if your situation is not clear-cut.
What are the penalties for GDPR violations?
The maximum administrative fine is up to €20 million or 4% of worldwide annual turnover, whichever is higher. That is the statutory ceiling and depends on the type of infringement and the regulator's assessment. It is not an automatic penalty for small businesses.
Is the EU-U.S. Data Privacy Framework enough on its own?
No. It covers the transfer of data to certified US organizations, but you still need a lawful basis, transparency, security, processor contracts and a way to respond to individual requests. Check that your vendor's certification is active and covers the data type involved.
Sources
- European Union - Data Privacy and Protection (trade.gov)
- Data protection under GDPR (Your Europe)
- Is My U.S.-Based Company Subject to the GDPR? (Amundsen Davis)
- Frequently Asked Questions (EDPB)
- Data protection basics (EDPB)
- How can I obtain valid consent? (EDPB FAQ)
- Data Privacy Framework Program Overview
- EU-U.S. Data Privacy Framework F.A.Q. for European businesses (EDPB)
- EU's General Court Confirms Adequacy of EU-U.S. Data Privacy Framework (Hunton)
- Data breaches (EDPB)