US company, European clients: what the GDPR requires outside the Union
The GDPR applies to a non-EU entity offering services to people in the Union. Article 27 then requires, in many cases, designating a representative in the EU.
A company formed in the United States may think the GDPR doesn't concern it. That is inaccurate as soon as it offers goods or services to people located in the European Union, or monitors their behavior: Article 3(2) then extends the regulation to its data processing, even without an EU establishment. For a group whose subsidiaries serve European customers from a US structure, this is a structural compliance question, not a detail.
The EU representative (Article 27)
In that case, Article 27 in principle requires designating in writing a representative established in the Union. The representative is a contact point for supervisory authorities and data subjects; it isn't liable in the entity's place, which remains solely bound to comply with the regulation (IAPP). An exemption exists for occasional processing that doesn't involve large-scale sensitive data and is unlikely to create a risk for individuals; it is interpreted strictly, and regular commercial activity toward European customers rarely fits. Authorities have already fined non-EU companies that failed to designate a representative.
The other elements of a coherent setup
- The legal basis for data transfers: when data of people in the EU is processed in the United States, a valid mechanism is needed — an adequacy decision (the Data Privacy Framework for certified companies, whose framework is being challenged on appeal before the Court of Justice) or standard contractual clauses.
- Records of processing and, where applicable, impact assessments.
- Information for individuals: a clear privacy policy, mention of rights and contact.
- A data-breach procedure: notification to the competent authority within 72 hours where the law requires it.
- Contracts with processors: data processing agreement, location, subprocessors.
What about other regimes?
A structure that also serves Switzerland or Canada meets regimes of its own — FADP/nFADP, PIPEDA — with their own transfer mechanisms. A multi-country group's compliance therefore rests on a map of applicable regimes, kept current according to where each client operates, rather than on a single "GDPR" compliance extended to everything.
A discipline more than a formality
Designating a representative and publishing a privacy policy are not enough if, in practice, nobody knows where the data is. Compliance rests on knowing the flows: which data, in which tools, hosted where, accessible to whom. Group governance that maps these flows from the companies' formation avoids having to reconstruct them under the pressure of an authority's request.
This article is general information, not legal advice; each entity's situation must be analyzed case by case.