What Is GDPR and How Does It Apply to a US Business? 2026 Guide

Article 3(2) extends the regulation to a controller or processor not established in the EU where the processing relates to offering goods or services to people in the EU, whether or not payment is required, or to monitoring their behavior within the EU. Recital 23 says mere accessibility of a website or an email address is not enough; what makes the intention apparent is using a language or currency of a member state, taking orders in that language, or mentioning EU customers.

Article 83 sets fines of up to 20 million euros or one twenty-fifth of worldwide annual turnover, whichever is greater, for the higher tier, and half of each for the lower.

Article 27 requires a controller or processor caught by Article 3(2) to designate, in writing, a representative established in one of the member states where the people whose data you process are. It does not replace a data protection officer, which Article 37 requires only when core activities involve large-scale regular monitoring or large-scale special-category data.

The exemption in Article 27(2) covers processing that is occasional, does not include large-scale special categories or criminal data, and is unlikely to result in a risk to people, and it covers public authorities. A firm that sold to three EU customers in a year may fit it; a software company with a steady EU customer base, a store that ships to the EU every week, or a marketing operation that profiles EU visitors does not, and should contract a representative.

A US company keeps its Microsoft 365 tenant in the United States, so the transfer question comes up at once. Three facts settle most of it:

1. Data you collect directly from a person in the EU is not a "transfer" in the Chapter V sense; the European Data Protection Board's Guidelines 05/2021 say a non-EU controller collecting directly from a data subject is simply subject to the regulation under Article 3(2).
2. Data an EU business sends you, for example a customer's employee list for a service you run, is a transfer, and the EU customer needs a Chapter V mechanism. On 11 October 2026 the EU-US Data Privacy Framework adequacy decision of 10 July 2023 remains in force: the General Court dismissed the Latombe challenge on 3 September 2025, an appeal (Case C-703/25 P) is pending at the Court of Justice, and on 31 July 2026 the European Data Protection Board asked the European Commission to examine whether a June 2026 US Supreme Court decision on the removal of Federal Trade Commission commissioners affects the framework. Most EU customers ask for the standard contractual clauses as well.
3. Your onward transfer to Microsoft as your processor is covered by Microsoft's Products and Services Data Protection Addendum, which incorporates the EU standard contractual clauses and Microsoft's GDPR processor commitments.

You cannot answer an access request or scope a breach for data you cannot locate. The inventory, in order:

1. List the systems: mailboxes, SharePoint sites, OneDrive, Teams, the CRM, the support desk, the accounting package, backups.
2. Run Content search in the Microsoft Purview portal against the EU sensitive information types Microsoft ships (passport, national identification, tax identification, driver's license, debit card and IBAN) and record the sites and mailboxes with hits.
3. On E5, or with the E5 Information Protection and Governance add-on, open Content explorer to see sensitive items by location without running searches.
4. Write the result into the Article 30 record: data category, purpose, lawful basis, location, retention period, who has access.

The GDPR Data Discovery Service ($15,000 per project) produces this inventory across Microsoft 365 and the connected systems; the Privacy Data Mapping and Impact Assessment ($4,950 per project) turns it into the Article 30 record and, where Article 35 requires one, the impact assessment.

Article 32 asks for security appropriate to the risk. The controls that answer it are already licensed in most tenants, Microsoft list prices from the October 2026 price list, per user per month on an annual term:

• MFA and Conditional Access on every account that can reach EU data: Entra ID P1 ($7.00), included in Business Premium ($22.00) and E3 ($39.00).
• Sensitivity labels with encryption on the documents that hold EU customer data, and data loss prevention policies that stop them leaving by email or sharing link: Microsoft's Purview licensing guidance lists both among the capabilities included in Business Premium, E3 and E5.
• Retention policies that delete customer records at the end of the stated period; keeping data past its purpose breaches Article 5. Basic retention is included in E3 and Business Premium; automatic labeling and adaptive scopes need E5 ($60.00), the E5 Information Protection and Governance add-on ($7.00) or the Purview Suite ($12.00).

Microsoft Purview Data Lifecycle Management Implementation ($4,500 per project) builds the retention schedule, and Configure and Enable DLP Policies ($8,000 per project) builds the policies that keep EU data inside the tenant.

The month runs from receipt, however the request arrives. The procedure for a firm without a privacy team:

1. Log the date received, the requester, the right invoked and the identity check performed; disclose nothing until the requester has proven who they are.
2. Search: Content search in Purview across mailboxes, SharePoint, OneDrive and Teams, plus the CRM and support desk exports.
3. Review and redact other people's data from the results.
4. Respond in a portable format with what Article 15 lists: purposes, recipients, retention period, source.

Microsoft Priva Subject Rights Requests automates steps 2 to 4 (search, duplicate detection, redaction, export, an audit trail), is sold separately and quoted on request; its plan page has the details. A firm with a handful of requests a year works by hand with Content search, and Microsoft Purview eDiscovery Search Assistance ($500 per project) runs one search for you when the month is running out.

Article 33 requires notice to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to people; Article 34 adds direct notice to the individuals when the risk is high.

The audit log is the whole case: keep it on, and extend it to a year with the E5 eDiscovery and Audit add-on ($6.00 per user per month) if that matters. Security Managed Service: Incident Response ($700 per project) covers the first 24 hours.

Every Microsoft subscription above is the customer's own charge at Microsoft's list price.

Does GDPR apply to us if EU visitors just read our website?

Not on that basis alone. Recital 23 says accessibility of a website is not enough; the regulation reaches you when you offer goods or services to people in the EU, for example with euro pricing or EU delivery, or monitor their behavior with profiling cookies.

Is the EU-US Data Privacy Framework still valid in October 2026?

Yes. The adequacy decision of 10 July 2023 remains in force: the General Court dismissed the Latombe challenge on 3 September 2025 and an appeal is pending at the Court of Justice. The European Data Protection Board asked the Commission on 31 July 2026 to examine the effect of a June 2026 US Supreme Court decision.

Do we need a data protection officer?

Article 37 requires one when core activities involve large-scale regular monitoring of people or large-scale special-category data. A services firm with ordinary customer records usually does not need one, but usually does need an EU representative under Article 27.

Does using Microsoft 365 make us GDPR compliant?

No. Microsoft's Data Protection Addendum covers Microsoft's obligations as your processor. Your lawful basis, notices, record of processing, rights procedure, breach plan and representative are yours.

How long do we have to answer an access request?

One month from receipt under Article 12(3), extendable by two further months for complex or numerous requests if you tell the person within the first month. The clock does not pause for an identity check.

• Regulation (EU) 2016/679 (General Data Protection Regulation) — EUR-Lex, checked 2026-10-11
• Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) — European Data Protection Board, checked 2026-10-11
• Guidelines 05/2021 on the interplay between Article 3 and Chapter V — European Data Protection Board, checked 2026-10-11
• EDPB calls for review of EU-U.S. Data Privacy Framework after U.S. Supreme Court decision on FTC independence — Hunton Andrews Kurth, Privacy and Cybersecurity Law Blog, checked 2026-10-11
• Data Privacy Framework program — US Department of Commerce, checked 2026-10-11
• Microsoft Products and Services Data Protection Addendum (DPA) — Microsoft, checked 2026-10-11
• General Data Protection Regulation (GDPR) in Microsoft products and services — Microsoft Learn, checked 2026-10-11
• Sensitive information type entity definitions — Microsoft Learn, checked 2026-10-11
• Microsoft Purview licensing guidance — Microsoft, checked 2026-10-11
• Learn about Priva Subject Rights Requests — Microsoft Learn, checked 2026-10-11