GDPR for US Companies: Do You Need to Care?

Many US small businesses assume GDPR is a Europe problem. Sometimes that is right. Sometimes it is not. The regulation looks at whose data you handle and what you do with it, not only where your office sits. A Reno accounting firm with no European presence can still have a question to answer.

This is general education, not legal advice. Whether GDPR applies to you is a legal question, and an attorney who knows the regulation should answer it for your situation.

When GDPR can reach a US business

GDPR can reach US businesses that offer goods or services to people in the EU or EEA, or that monitor their behavior. Here are some situations worth thinking through:

• You deliberately serve clients who live in the EU, for example an expat tax practice with clients in Europe, or a website that is aimed at EU customers.
• You track visitors from the EU through analytics or similar tools in a way that amounts to monitoring behavior.
• You process personal data for a company that is subject to GDPR; your contract may then require you to follow GDPR-style rules.

A single stray email from a European does not automatically bring you under the regulation, but a regular practice of serving people there might. If you are unsure, that uncertainty is the signal to ask a lawyer.

Principles that matter most in practice

• Lawful basis. Have a defensible reason for processing each category of personal data.
• Data minimization. Collect and keep only what you need, and for no longer than you need it.
• Individual rights. People can ask what you hold about them and, in many cases, ask you to delete it. You have to be able to find the data to respond.
• Security and breach notification. You must protect the data and, for qualifying breaches, report on a deadline set by the regulation. Check the current text for the exact timing.

US rules differ in detail. The FTC Safeguards Rule, PCI DSS and state laws such as Nevada's NRS Chapter 603A each have their own scope. If you are covered by several regimes at once, your attorney can help sort out which obligations overlap.

The common thread: knowing where the data is

A deletion request or a breach investigation both begin with the same question: where is this person's data? If the honest answer is "probably in the main system and maybe a few other places," you cannot answer quickly or completely. That is true whether the rule is GDPR, a state breach law, or a client's security questionnaire.

A scan of your computers helps with the first part of that question. MyVaultMate looks for Social Security numbers and ITINs, payment card numbers, labeled driver's license, passport and date-of-birth values, medical record numbers, Medicare numbers and health insurance member IDs, a health-information keyword signal, and, for GDPR, international bank account numbers (IBANs), EU and UK national ID numbers (UK National Insurance, Spanish DNI and NIE, Italian codice fiscale, French social security numbers and others) and keywords that suggest special-category data such as religion or ethnic origin, in Word and Excel (new and old formats), PDF, text, CSV, JSON, XML, HTML, .eml and Outlook .msg files across local drives, synced cloud folders and external disks. It also flags email addresses and phone numbers, but it does not search for a named person, so it cannot by itself pull together everything held about one individual. Treat it as a way to find the biggest exposures of sensitive data, not as a search tool for an erasure request. Fixing, moving, encrypting and deleting are done by you or your IT provider.

A practical sequence for this month

1. Ask whether you intentionally serve people in the EU or EEA, or track their behavior. Write down the answer and the reasoning.
2. If the answer is possibly yes, book time with an attorney who works with GDPR.
3. Make an inventory of where personal data lives: systems, computers, cloud folders, email, external disks.
4. Scan to find sensitive files outside the systems you already track, and clean up what you do not need.
5. Write down how you would handle a request to delete data, and who would do it.

Even for offices that never become subject to GDPR, the habits it encourages, such as knowing what you hold, keeping less and responding quickly, are sound practice. You can see what a report looks like at /sample, or start a 14-day trial at /trial/ (a card is required and never charged automatically: the 14 days start at your first computer, and you choose a plan when they end).