GDPR in the US is a question about reach rather than about geography. A company with no European office, no European bank account and no intention of selling there can still be in scope, and a company with European customers can sometimes be out of it. Two tests decide it, and both are about what you do rather than where you sit.
The two tests
First, offering goods or services to people in the region, whether or not payment is required. What counts is evidence of intention to offer: pricing in euros, a language version, shipping options, references to European customers. A site that merely happens to be reachable from Europe is not caught by accessibility alone. Second, monitoring the behavior of people in the region, which reaches analytics and profiling of European visitors even where nothing is sold. The second test is the one that surprises people.
What follows when you are in
A lawful basis for each purpose. Transparency information given at collection. The rights: access, correction, erasure, restriction, portability and objection, with a response inside one month, extendable by two further months for complex or numerous requests. A record of processing activities. Processing agreements with vendors. A transfer mechanism for data moving to the United States. Breach notification. And, where there is no establishment in the region, a representative there unless an exemption applies.
Transfers, which are the specifically American part
Moving personal data from the region to the United States needs a lawful transfer mechanism. The usual routes are the Commission's standard contractual clauses incorporated into the vendor contract with the annexes filled in, or certification under the framework the Commission has recognized for US organizations. Either way the paperwork lives with the vendor contracts, and empty annexes are the commonest defect: the annexes are where the processing, the security measures and the sub-processors are actually described.
How it sits beside California
Build one notice and one process. The rights overlap heavily: access, deletion and correction exist in both, the deadlines differ, and each adds something the other lacks. California adds the sale and sharing opt-out, the sensitive information limit and the retention statement; the European regime adds the legal basis, the transfer safeguard and the representative. A small company that answers requests inside forty five days and keeps one honest notice is most of the way to both.
Questions people ask about GDPR in us
Does having one EU customer put us in scope?
It is evidence rather than a rule. The test is whether you are offering to people in the region, and one deliberate sale with euro pricing and EU shipping points firmly at yes.
Can we just block EU traffic?
It is a real option and it has to be actual: geo-blocking, no EU shipping, no euro pricing, no European language version. Half-blocking while still taking the orders is worse than either.
Which deadline applies if both laws reach us?
Both, to their own requests. The practical answer is to run the shorter clock as the internal target so neither is missed.