# GDPR for online stores selling into the EU > When the GDPR applies to a store outside the EU, who needs an Article 27 representative, what it requires day to day and how to move EU customer data abroad. Source: https://border.bot/docs/guides/countries/european-union/gdpr Last updated: 2026-10-30 > Documentation index: https://border.bot/llms.txt. Every page is Markdown at its URL + `.md`. The General Data Protection Regulation (GDPR) applies to a store outside the EU whenever it offers goods or services to people in the EU, so a seller that markets to and ships to EU customers has to follow it, and in most cases name a representative in the EU. Where your company is based doesn't change that; who you sell to does. Rules as of 30 October 2026. ## When does the GDPR apply to a store outside the EU? The GDPR applies to a business established outside the EU when it processes personal data of people in the EU in connection with offering them goods or services, paid or free, or with monitoring their behavior in the EU. Article 3(2) of the regulation sets this out, and the test is whether you deliberately target people in the EU, not whether they can reach your site. The European Data Protection Board lists signs that a business targets the EU: prices in euros or another EU currency, a site in an EU language other than the one used at home, delivery to EU member states, an EU domain such as .de or .eu, or EU phone numbers. Several of these together usually settle it. A site that is merely reachable from the EU, or a one-off order from someone who happened to be there, doesn't bring a business into scope on its own. For a cross-border store, offering EU delivery at checkout and pricing in euros is normally enough. Treat the GDPR as applying to EU customers if you ship to them. - [ ] Designate an EU representative in writing and name it in your privacy notice - [ ] Publish a privacy notice that covers each use of customer data and its lawful basis - [ ] Set up a way to answer access, correction and erasure requests - [ ] Check every recipient outside the EU: Data Privacy Framework participant or standard contractual clauses - [ ] Have a plan to report a breach within 72 hours ## Do you need a GDPR representative in the EU? A business outside the EU that falls under the GDPR through Article 3(2) must designate, in writing, a representative established in one of the member states where its customers are. Article 27 makes this the default, and the representative is the contact point for data protection authorities and for customers in the EU. The only exceptions are public bodies and processing that is occasional, doesn't involve special categories of data or criminal records on a large scale, and is unlikely to put people's rights at risk. The European Data Protection Board reads "occasional" as processing that isn't regular and falls outside the business's normal activity, so a store that sells to EU customers as part of its business almost always needs a representative. The representative's name and contact details belong in your privacy notice. Appointing one doesn't shift your legal responsibility, but authorities can address orders and fines to you through the representative, who must be able to deal with customers and authorities in their languages. ## What does the GDPR require of a store day to day? Under the GDPR a store needs a lawful basis for each use of personal data, a clear privacy notice, a way to handle people's requests and a plan for breaches. Most of the data a store holds, names, addresses, order histories and payment references, is personal data, and so is pseudonymized data that can still be linked back to a person. Customers in the EU have the right to be informed, to access their data, to correct it, to have it erased, to restrict processing, to move it to another provider, to object, and rights around automated decisions. A personal data breach must be reported to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to put people at risk. The most serious infringements can be fined up to €20 million or 4% of worldwide annual turnover, whichever is higher. ## Can you transfer EU customer data outside the EU? Personal data can leave the EU only under the GDPR's transfer rules: to a country the European Commission has found adequate, or with safeguards such as standard contractual clauses. That covers your own systems abroad as well as the apps, payment providers and fulfillment partners you share customer data with. For the United States, the Commission adopted an adequacy decision for the EU-US Data Privacy Framework on 10 July 2023, so data can flow without extra safeguards to US companies that take part in the framework. On 3 September 2025 the EU General Court dismissed a challenge to that decision. For partners outside the framework, or in countries without an adequacy decision, standard contractual clauses are the usual tool. Other markets have their own laws: Brazil's is covered in the [LGPD guide](https://border.bot/docs/guides/countries/brazil/lgpd). For the product side of selling into the EU, see [GPSR](https://border.bot/docs/guides/countries/european-union/gpsr), and for cancellations, the [right of withdrawal](https://border.bot/docs/guides/countries/european-union/right-of-withdrawal). The [EU import guide](https://border.bot/docs/guides/countries/european-union) covers duty and VAT. ## Common questions ### Does the GDPR apply if my business is in the United States? Yes, if you offer goods to people in the EU, for example by shipping to EU addresses or pricing in euros. Being established outside the EU doesn't exempt you; deliberately targeting EU customers brings you in. ### Is a GDPR representative the same as a data protection officer? No. The representative is the EU contact point that a business outside the EU must designate under Article 27. A data protection officer is a different role with its own rules in the GDPR. ### Can I send EU customer data to US apps and services? Yes, to US companies that participate in the EU-US Data Privacy Framework, which the Commission found adequate in July 2023. For other recipients, use another transfer tool such as standard contractual clauses. ## Sources - [Regulation (EU) 2016/679, General Data Protection Regulation (Articles 3, 27, 33, 44 and 83)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504), EUR-Lex, consolidated version of 4 May 2016, the current text - [Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)](https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en_1.pdf), European Data Protection Board, version 2.1 of 7 January 2020 - [Data protection explained](https://commission.europa.eu/law/law-topic/data-protection/data-protection-explained_en), European Commission, accessed 30 October 2026 - [EU-US data transfers](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en), European Commission, accessed 30 October 2026 - [Press release No 106/25: judgment in Case T-553/23, Latombe v Commission](https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-09/cp250106en.pdf), General Court of the European Union, 3 September 2025 - [Fines](https://www.edpb.europa.eu/topics/cooperation-enforcement/fines_en), European Data Protection Board, accessed 30 October 2026