What Is GDPR? A Complete Guide for US Companies

What GDPR Requires

Lawful Basis for Processing

GDPR requires that every instance of personal data processing have a lawful basis. The six lawful bases are consent, contract performance, legal obligation, vital interests, public task, and legitimate interests. Consent — the most commonly cited but most operationally demanding basis — must be freely given, specific, informed, and unambiguous, and can be withdrawn at any time. Organizations that rely on consent for processing must maintain records of consent and honor withdrawal requests promptly.

Data Subject Rights

GDPR grants EU residents extensive rights over their personal data: the right to access their data, the right to rectification of inaccurate data, the right to erasure (the right to be forgotten), the right to restriction of processing, the right to data portability, and the right to object to processing. Organizations must respond to data subject requests within one month and have the technical capability to fulfill erasure requests across all systems where the individual's data is stored.

Breach Notification

GDPR requires notification to the relevant supervisory authority within 72 hours of becoming aware of a personal data breach. If the breach is likely to result in high risk to individuals, those individuals must also be notified without undue delay. The 72-hour requirement is one of the most operationally demanding aspects of GDPR for organizations without mature incident response processes.

GDPR Enforcement and Penalties

GDPR enforcement is conducted by Data Protection Authorities in each EU member state. Penalties are structured in two tiers. The lower tier — up to €10 million or 2% of global annual revenue, whichever is higher — applies to violations of organizational obligations including data protection by design, records of processing activities, and processor contracts. The higher tier — up to €20 million or 4% of global annual revenue — applies to violations of core principles including lawful basis for processing, data subject rights, and international transfer restrictions.

Total GDPR fines issued across the EU exceeded €4 billion through 2023. Major fines include Meta's €1.2 billion penalty for transferring EU user data to the US, Amazon's €746 million fine for advertising targeting practices, and WhatsApp's €225 million fine for transparency failures.

GDPR Diligence in M&A

For PE buyers acquiring companies with European operations or European customer relationships, GDPR exposure is a standard diligence finding. The questions: What is the company's lawful basis for processing each category of personal data? Are data processing agreements in place with all data processors? Has a Data Protection Impact Assessment been conducted for high-risk processing activities? Where is data being transferred to, and are appropriate transfer mechanisms in place? Are the legal bases for processing documented for each processing purpose? Is there a breach notification process that meets the 72-hour requirement? These questions reveal whether GDPR compliance is operational or aspirational.

Related: Compliance Risk Assessment for GDPR Programs

GDPR compliance programs are most effectively built on the foundation of a formal compliance risk assessment — one that identifies which GDPR obligations apply to the organization, where current practices fall short, and where the highest-impact gaps lie. For organizations subject to multiple regulatory regimes (GDPR plus HIPAA, PCI DSS, or sector-specific rules), the compliance risk assessment surfaces opportunities to consolidate control work across frameworks.

What is GDPR?

The General Data Protection Regulation is the European Union's comprehensive data privacy law, in force since May 2018. It governs how organizations collect, process, store, and transfer personal data of EU residents, regardless of where the organization itself is located. GDPR has become the de facto global standard for privacy regulation, influencing laws in California, Brazil, Japan, and dozens of other jurisdictions.

How does GDPR apply to US companies?

GDPR applies extraterritorially to any organization that offers goods or services to EU residents or monitors their behavior, regardless of where that organization is based. A US company with EU customers, EU website visitors tracked through analytics, or EU employees is in scope. Enforcement against US companies is real: Meta has paid over $2.5 billion in GDPR fines, and smaller US companies have been fined for violations involving as few as a handful of EU records.

What are the core requirements under GDPR?

Organizations must establish a lawful basis for processing personal data, typically consent, contract, or legitimate interest. Data subjects gain rights to access, correct, delete, and port their data. Privacy notices must clearly explain processing purposes. Data Protection Impact Assessments are required for high-risk processing. Cross-border data transfers require specific safeguards. Breaches must be reported to supervisory authorities within 72 hours. Organizations processing data at scale must appoint a Data Protection Officer.

What tools and platforms support GDPR compliance?

Privacy management platforms including OneTrust, TrustArc, and Securiti automate consent management, data subject request handling, and processing records. Data discovery tools like BigID and Spirion locate personal data across the environment. Cloud providers AWS, Azure, and Google Cloud offer EU regions and Standard Contractual Clauses for compliant transfers. Cookie management platforms like Cookiebot and Osano handle the consent banner requirement.

How do US companies build a GDPR program?

Programs typically start with data mapping to identify what personal data is collected, where it flows, and on what legal basis. Privacy notices are rewritten to GDPR standards. Vendor contracts are updated to include Data Processing Agreements. Internal procedures handle data subject requests within the 30-day deadline. International data transfers are documented using Standard Contractual Clauses or other transfer mechanisms. The program is then operationalized through automation tooling and ongoing training.

What are the penalties for GDPR violations?

Fines tier up to the greater of 20 million euros or 4 percent of annual global revenue for the most serious violations, with a lower tier at 10 million euros or 2 percent for administrative failures. Major fines in recent years have hit Meta, Amazon, Google, and TikTok at over 1 billion euros each. Beyond fines, organizations face supervisory authority investigations, mandatory remediation orders, and reputational damage that often exceeds the direct cost.

What is the first step in GDPR compliance?

Conduct a data inventory to identify whether you process EU personal data and what that processing looks like. Many US companies discover their exposure is greater than expected once they audit website analytics, marketing automation, and customer support tools. The inventory becomes the foundation for every other GDPR activity including lawful basis assessment, privacy notice updates, and DPIAs.

Real-World Example: Meta's €1.2 Billion Fine — Largest GDPR Penalty

In May 2023, Ireland's Data Protection Commission fined Meta €1.2 billion — the largest GDPR fine in the regulation's history — for transferring EU Facebook user data to the United States without adequate safeguards. The ruling followed years of legal proceedings triggered by Austrian activist Max Schrems and the earlier Schrems II decision that invalidated the Privacy Shield framework previously used for EU-US data transfers. Meta was required to suspend future data transfers and bring existing EU user data processing into compliance within specific timelines.