The GDPR applies to non-EU citizens whenever they are physically present in the EU or European Economic Area at the moment their personal data is collected or processed, and it applies to non-EU organizations that offer goods or services to, or monitor the behavior of, people located there. Nationality is not what turns the regulation on. Recital 14 states that its protections extend to natural persons “whatever their nationality or place of residence.”1DSGVO Portal. Recital 14 GDPR An American on holiday in Rome, a Brazilian student in Berlin, and a Japanese executive at a Paris conference each get the same data protection rights as a lifelong French resident while they are in the territory.
Location Is the Trigger, Not Citizenship
The GDPR defines a “data subject” as any identified or identifiable natural person. The definition says nothing about passports, visas, or residency.2General Data Protection Regulation (GDPR). Art. 4 GDPR Definitions Article 3(2) sets the territorial scope by asking whether the person is “in the Union” when the processing happens. That physical presence can be brief. A layover counts. So does a two-week vacation, a business trip, or a semester abroad.
The consequence is straightforward. If you are a non-EU citizen and you book a hotel in Lisbon, sign up for a Wi-Fi hotspot in Amsterdam, or hand over your details at a Munich pharmacy, the organization handling that data is bound by the GDPR in how it treats it. Your nationality does not shrink your rights, and it does not enlarge them either.
EU Citizens Outside the EU Are Not Automatically Covered
The same logic runs in reverse, which surprises many people. A French citizen living in New York does not automatically carry GDPR rights over data a U.S. company collects from her in the United States. A German national working in Tokyo cannot invoke the regulation against a Japanese employer processing his data locally. Protection follows physical presence in the EU at the time of processing, not the nationality on the passport.
Two situations soften that line. If the processing is carried out through an organization’s EU establishment, the GDPR applies wherever the data subject happens to be. And if a non-EU company specifically targets people in the EU with goods or services, the regulation reaches that targeting activity even if some of the individuals affected are EU citizens who moved abroad. In both cases the hook is the organization’s connection to the EU, not the individual’s citizenship.
When Non-EU Organizations Must Comply
A company with no office, no server, and no employee in Europe can still fall under the GDPR. Article 3(2) sets out two ways this happens.
Offering Goods or Services to People in the EU
If an organization offers goods or services (paid or free) to individuals located in the EU or EEA, the GDPR applies to how it processes their data. Recital 23 makes clear that a globally accessible website is not, by itself, enough. What matters is whether the organization shows intent to direct its offerings toward people in the EU.3General Data Protection Regulation (GDPR). Recital 23 GDPR – Applicable to Controllers/Processors Not Established in the Union
Signals regulators weigh include using a language or currency tied to an EU member state (not simply English, which is used everywhere), offering shipping into EU countries, mentioning EU-based customers, running advertising aimed at EU audiences, or using a European top-level domain such as .de or .eu. A U.S. e-commerce site that prices in euros, ships to Germany, and translates its checkout into German is targeting EU consumers. A U.S. blog written in English that happens to attract European readers is not.
Monitoring the Behavior of People in the EU
The second trigger is monitoring behavior that takes place within the EU. Recital 24 treats this as including tracking people on the internet and using profiling to analyze or predict their preferences and behaviors. In practice that covers tracking cookies that follow users across sites, advertising profiles built from browsing history, browser fingerprinting, tracking pixels, and analytics tools that identify individuals.4Autoriteit Persoonsgegevens. Tracking Cookies A non-EU website that drops tracking cookies on visitors from EU countries and uses that data for targeted advertising is monitoring behavior in the EU. The GDPR governs that processing regardless of where the servers sit.
The EU Representative Requirement
Non-EU organizations caught by Article 3(2) generally have to appoint a representative located in the EU. That representative is the point of contact for supervisory authorities and for the individuals whose data the organization handles. A narrow exemption exists for processing that is occasional, does not involve sensitive data on a large scale, and is unlikely to pose a risk to individuals’ rights. Public authorities are also exempt.5General Data Protection Regulation (GDPR). Art. 27 GDPR – Representatives of Controllers or Processors Not Established in the Union
Moving Data Out of the EU
Collecting data from people in the EU is one question. Moving it out is another, and GDPR Articles 44 through 49 restrict transfers to countries the European Commission has not judged to offer an adequate level of protection, which covers most of the world.
For U.S.-based companies the main route is the EU-U.S. Data Privacy Framework, which took effect on July 10, 2023, when the European Commission adopted an adequacy decision for the program. U.S. organizations self-certify through the Department of Commerce’s International Trade Administration, publicly committing to comply with the framework’s principles, and that commitment is enforceable under U.S. law. Participants re-certify annually.6Data Privacy Framework. Data Privacy Framework Program Overview
Organizations that do not participate, or that sit in other countries, typically rely on Standard Contractual Clauses approved by the European Commission. These are pre-approved model contract terms signed by the exporter and importer, binding the recipient to handle data in line with GDPR standards. The Commission issued modernized versions in June 2021 for transfers from EU-based controllers or processors to non-EU recipients.7European Commission. Standard Contractual Clauses (SCC) Other mechanisms exist, including binding corporate rules for multinational groups and specific derogations for occasional transfers, but the clauses remain the most widely used tool.
What Protection Actually Looks Like
Once the GDPR covers processing of your data, you gain a defined set of rights. Organizations have to respond to your requests within one month, and the response is free. Complex requests can extend by another two months, but the organization must tell you about the extension inside that first month.8European Data Protection Board. How Long Do I Have to Respond to an Access Request The rights include:
- Being told, at the time of collection, what data is being gathered, why, and how it will be used.
- Access to a copy of the data an organization holds about you.
- Correction of inaccurate or incomplete information.
- Erasure of your data where no compelling reason exists to keep it (the “right to be forgotten”).
- Restriction of certain kinds of processing while the data stays on file.
- Portability, meaning you can obtain your data in a common machine-readable format and move it elsewhere.
- Objection to certain processing, including direct marketing; when you object to marketing, processing must stop.
- Protection against decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you.
These rights apply equally to every data subject the GDPR covers, whether you are a European national or a visitor who landed that morning.9General Data Protection Regulation (GDPR). Art. 13 GDPR – Information to Be Provided Where Personal Data Are Collected from the Data Subject
Enforcement Against Non-EU Companies
A fair question from any organization sitting outside Europe is what regulators can actually do. The Article 27 representative requirement gives supervisory authorities a domestic point of contact for corrective measures and fines against non-compliant foreign organizations.5General Data Protection Regulation (GDPR). Art. 27 GDPR – Representatives of Controllers or Processors Not Established in the Union Beyond that, EU authorities have explored ordering internet service providers within their jurisdiction to block access to non-compliant websites, freezing assets that a non-EU company holds within the EU, and referring violations to criminal courts whose decisions may be enforceable internationally.10European Data Protection Board. Study on the Enforcement of GDPR Obligations Against Entities Established Outside the EEA In some member states GDPR violations are also criminal offenses, opening the door to mutual legal assistance treaties.
Fines are structured in two tiers, capped at either €10 million or 2% of global annual turnover for organizational violations, and €20 million or 4% for violations of core processing principles, data subject rights, consent, and international transfer rules (whichever figure is higher in each tier). Supervisory authorities across the EU have issued fines in the hundreds of millions of euros against major technology companies for issues including insufficient consent mechanisms and unlawful data transfers.11General Data Protection Regulation (GDPR). Art. 83 GDPR – General Conditions for Imposing Administrative Fines Any company with EU customers, EU revenue, or assets in Europe has something regulators can reach.