The article
For a US company, the first GDPR question is whether the law applies at all. The answer depends on what you do, not where you are: the European Commission says the GDPR applies to a company established outside the EU when it offers goods or services to people in the EU, paid or free, or monitors their behavior there. Good GDPR compliance services start by answering that question with your facts, then change your software to match the answer.
I have been building software for 18 years. My team is 70+ specialists, with a delivery center near Kyiv, an EU entity in Tallinn and me in Miami. We do the technical side of the GDPR: the data map, consent that works, rights requests your system can answer, privacy in the code and tests that show it. Whether the law applies to you, which lawful basis fits each use of data and how your notices read are your counsel's decisions; we bring the facts and build what those decisions require.
GDPR compliance services: the short version
| What | How it works |
|---|---|
| For | US and EU companies with customers, users or staff in Europe |
| We do | The data map, consent and cookies, rights requests, the technical side of vendor contracts, privacy in your software, testing |
| Your counsel decides | Whether the GDPR applies, the lawful basis for each use, the wording of your notices |
| Price | Estimated before work starts, after a free first call and a free rough estimate |
| Our first reply | Within 30 minutes, weekdays 9-18 Miami time |
Does the GDPR reach your US company? A self-check
Our GDPR compliance services for US companies start with this check, because the market describes the law's reach more loosely than the regulators do. Of the five pages Google showed me for this search in October 2026, three say, in one form or another, that the GDPR applies to any business that touches the data of anyone in the EU; one counts the data of EU citizens, down to a single one. Only one explains the "offering goods or services" test, none explains the monitoring test, one mentions the EU representative, and none names a price for its own service. Five pages are a small sample, but it is enough to show why the check matters.
The European Data Protection Board (EDPB) lists the signs that a company outside the EU offers goods or services to people in the EU. Answer these for your site, app and campaigns:
- Do you name an EU country next to what you sell?
- Do your ads or search campaigns aim at an EU audience?
- Do you use a .de, .fr, .eu or another EU domain?
- Do you show prices in euros, or pages in an EU language other than English?
- Do you deliver to EU addresses?
- Do you show reviews from customers in several EU countries?
- Do you give EU phone numbers or addresses to reach you?
Each yes is a sign the EDPB counts, and one alone may not decide it. What does not count on its own: a site that simply opens in Europe, an email address, or a phone number without an international code.
The second trigger: monitoring behavior
For this trigger the EDPB looks at tracking and profiling rather than at intent to target: its examples include behavioral advertising, tracking with cookies or fingerprinting, location tracking for marketing and online health analytics. If your scripts profile visitors in the EU, add that to the list you bring to your counsel.
What changes in your software
Once the answer is yes, the GDPR stops being a policy question and becomes a list of features:
- A data map. Every field you collect, why, where it is stored, who can see it and which vendor receives it. Nothing below can be checked without it.
- Consent that works. Your counsel decides which trackers need consent. We make sure none of them loads before the visitor chooses, and that the choice holds on every page and every visit.
- Rights requests your system can answer. The Commission expects a reply without undue delay and in principle within one month, free of charge. Plan where a deletion must reach: the database, the backups, the logs and the vendors that got a copy.
- Breach detection. A breach likely to put people at risk goes to the supervisory authority without undue delay, at the latest within 72 hours of becoming aware of it. You meet that only if your systems tell you fast.
Design, vendors and transfers
Three more items shape your architecture and your contracts:
- Privacy by design and by default. The Commission's description: process only the data needed for the purpose, keep it for the shortest possible time and open it only to the people who need it. In code: fewer form fields, deletion jobs, access by role.
- Processors under contract. A vendor may process personal data for you only under a contract: your documented instructions, confidentiality, security and help with compliance. It may not bring in another processor without your written authorization.
- Transfers. When personal data leaves the European Economic Area, the Commission expects safeguards to travel with it: an adequacy decision, standard contractual clauses or another tool from its list. Its adequacy decision of 10 July 2023 covers US companies that take part in the EU-US Data Privacy Framework; for other recipients, your counsel picks the tool.
GDPR compliance testing services: what we check
A privacy policy describes what your site and app should do. Our tests check what they actually do, line by line:
| Your policy says | We check |
|---|---|
| Cookies only with consent | Which cookies and scripts load before the visitor chooses |
| We collect only what we need | Every form field against the data map |
| You can ask us to delete your data | A test request: what the deletion reaches, and what it misses |
| We share data with these partners | Every request your pages and app send to third parties |
| We keep data for a set time | Whether the deletion job exists and runs |
| Access is limited | Who can reach the data, including people outside your team |
You get each difference with a fix: change the code, or ask your counsel to change the policy.
The representative, the DPO and the records
Three requirements are easy to miss for a company outside the EU:
- A representative in the EU. A company that falls under the GDPR this way designates a representative in writing, established in an EU country where its users are. The exemption is narrow: occasional processing that excludes large-scale processing of sensitive data and is unlikely to put people at risk, or a public authority. The representative does not take over your liability.
- A data protection officer. Required when your core activities are large-scale processing of sensitive data, or large-scale, regular and systematic monitoring. We support your DPO with the engineering; whether you need one is your counsel's call.
- Records of processing. The Commission says companies with fewer than 250 employees do not need them unless processing personal data is a regular activity for them, puts people's rights at risk or involves sensitive data or criminal records. If your product handles user accounts every day, ask your counsel before you count on that.
Where our people are
Ask any vendor where the people who can reach your users' data sit. Ours: a delivery center near Kyiv, an EU entity in Tallinn and me in Miami; the team is usually seven hours ahead of Miami. Ukraine is outside the EU and not on the Commission's adequacy list, so for a project that touches European personal data, settle with your counsel how that access is covered before the work starts.
The habit we bring is the one behind every item above: the system records what happened. RxPhoto is a clinical photo platform; our part was the backend, the web front end and the API behind the mobile app. Its audit log records every action a user takes, so administrators can show who opened which record and when.
How it goes and what it costs
- Scope: where your users are, what you collect and which vendors receive it; the self-check above goes to your counsel.
- Map and gaps: the data map, compared with your notices and your code.
- Fixes: consent, requests, deletion, logs and the technical side of vendor contracts, built into your product.
- Proof: test results and records, kept current.
The estimate depends on how many products and data stores you have, how many vendors receive personal data and how far the code is from the map. It comes before any work starts, and the first call and the rough estimate are free.
Where to go next
Data privacy compliance covers California and the other US state laws next to the GDPR. Data management compliance keeps records classified and deleted on schedule, cloud compliance sets up AWS, Azure or Google Cloud, and incident response helps when the 72-hour clock starts. If you are not sure which rules apply, start with compliance consulting; the other rules we handle are listed on the compliance page.
Tell us where your users are and what your product collects. We answer with the first steps we see and a rough estimate, free. If you want to check us first: 5.0 on Clutch from 26 verified reviews as of September 2026, none of them negative.
