The General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) applies to any US business that handles personal data of EU residents, regardless of where the US business is located. If you are a US company signing a contract with a European partner, supplier, franchisee, or customer, GDPR compliance must be addressed directly in your agreements. Ignoring it does not create an exemption. Penalties for GDPR violations can reach 4% of global annual revenue or EUR 20 million, whichever is higher, and enforcement by EU data protection authorities has increased significantly since 2020. At Lopes Law LLC, we help US businesses that work with European counterparties understand what their contracts must contain to be GDPR-compliant.

This guide explains when GDPR applies to US businesses, what contract provisions are required, how GDPR affects franchise agreements with EU franchisees, and how the EU-US Data Privacy Framework (DPF) changes the landscape. This is general guidance and not legal advice for any specific situation. GDPR compliance requires analysis of your specific data processing activities.

When Does GDPR Apply to US Businesses?

GDPR has extraterritorial scope under Article 3. It applies to US businesses in three situations: when the US business offers goods or services to EU residents (even free of charge); when the US business monitors the behavior of EU residents (including through website tracking, analytics, and retargeting); or when the US business processes personal data on behalf of an EU-based controller.

This means that even if your US business has never opened an EU office, never incorporated in the EU, and never signed a contract with an EU company, you may still be subject to GDPR if your website is accessible to EU residents and you use cookies or analytics to track their behavior. For US businesses with EU counterparties, the contractual relationship is typically enough to trigger GDPR obligations on both sides.

What Is “Personal Data” Under GDPR?

GDPR’s definition of personal data is broader than most US data privacy laws. Personal data means any information relating to an identified or identifiable natural person. This includes: names, email addresses, postal addresses, phone numbers, IP addresses, cookie identifiers, location data, biometric data, health data, and any other information that can be linked to an individual directly or indirectly.

This broad definition means that almost any business relationship involving employees, customers, or individual contractors involves personal data. An NDA between two businesses that includes employee contact information, employee names as authorized recipients, or any customer data shared as part of due diligence is processing personal data subject to GDPR.

Who Is a Controller vs. a Processor Under GDPR?

The GDPR distinguishes between controllers (who determine the purposes and means of processing personal data) and processors (who process personal data on behalf of the controller). This distinction determines what contractual obligations apply. A Data Processing Agreement (DPA) is required whenever a processor processes personal data on behalf of a controller.

In most US-EU business relationships, the EU party is the controller (they determine why and how the data is used) and the US party may be the processor (they process the data as instructed by the EU controller). However, the analysis can be more complex. Both parties may be controllers in some situations. Getting the controller/processor analysis right determines which GDPR Article 28 provisions must be included in your contracts.

What GDPR Provisions Must Be Included in International Business Contracts?

International contracts between US and EU parties that involve personal data require specific GDPR provisions. The minimum required set includes the following:

Data Processing Agreement (DPA) Required Under Article 28

GDPR Article 28 requires that whenever a processor processes personal data on behalf of a controller, the parties must have a written contract (the DPA) that specifies: the subject matter, duration, nature and purpose of the processing, the type of personal data, the categories of data subjects, and the obligations and rights of the controller. The DPA must include specific terms obligating the processor to process data only on documented instructions from the controller, ensure confidentiality, implement appropriate security measures, assist the controller with data subject rights, delete or return data upon termination, and allow for audits.

At Lopes Law LLC, we draft and review DPAs for US businesses that process EU personal data on behalf of EU controllers. The DPA must be attached to or incorporated by reference into the main commercial agreement.

Standard Contractual Clauses (SCCs) for Data Transfers

The United States is not on the European Commission’s list of countries deemed adequate under GDPR for data transfers. This means personal data cannot flow from the EU to the US without a transfer mechanism. The most common transfer mechanism is Standard Contractual Clauses (SCCs), which are pre-approved contract terms issued by the European Commission.

The current SCCs are the 2021 SCCs issued under Commission Decision C(2021)3972. They replaced the 2010 SCCs and include four modules: controller-to-controller (Module 1), controller-to-processor (Module 2), processor-to-controller (Module 3), and processor-to-processor (Module 4). The appropriate module must be selected based on the roles of the parties. These clauses are mandatory and cannot be modified (though optional or additional clauses may be added as long as they do not contradict the SCCs).

Many US businesses simply incorporate the SCCs by reference in their commercial agreements without fully understanding which module applies. At Lopes Law LLC, we review these selections carefully because the wrong module can create compliance gaps that expose the US business to enforcement risk.

Data Subject Rights Provisions

GDPR gives EU data subjects (individual people whose data is being processed) specific rights: the right of access (Article 15), the right to rectification (Article 16), the right to erasure or “right to be forgotten” (Article 17), the right to restriction of processing (Article 18), the right to data portability (Article 20), and the right to object (Article 21).

Contracts between US and EU parties that involve personal data must address how these rights will be honored. If an EU data subject submits a deletion request to the US processor, the contract must specify who is responsible for honoring it, what the timeline is (GDPR requires response within one month, extendable to three months), and how the US party’s systems handle deletion technically.

For franchise agreements specifically: if the US franchisor’s technology platform processes EU customer data, and an EU franchise customer submits a deletion request, the franchise agreement must clearly allocate responsibility for honoring that request between the US franchisor (as controller or joint controller) and the EU franchisee.

Data Breach Notification Provisions

GDPR Article 33 requires data controllers to notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it. Article 34 requires notifying affected data subjects if the breach is likely to result in a high risk to their rights and freedoms. Contracts must allocate breach notification responsibilities between the parties and establish internal reporting timelines that allow the 72-hour public notification requirement to be met.

For US processors receiving EU personal data, the contract should require the US processor to notify the EU controller of a data breach within a specified timeframe (typically 24 hours) so the controller can make the required supervisory authority notification within the 72-hour window. A contract that simply says “notify promptly” without specifying a timeline is inadequate for GDPR purposes.

What Should a GDPR-Compliant NDA Include?

Many NDAs are signed before the parties have a clear picture of what data will be shared. A GDPR-compliant cross-border NDA should at minimum include the following provisions where personal data may be involved:

• Identification of personal data categories: If the scope of the NDA includes information about employees, customers, or other individuals, identify the categories of personal data that may be shared (names, contact information, health data, etc.).
• Compliance with applicable data protection law: Each party agrees to comply with applicable data protection law in processing any personal data shared under the NDA. This provision should expressly reference GDPR for EU parties.
• Separate DPA trigger: If the NDA results in one party processing personal data on behalf of the other, the parties agree to execute a DPA consistent with GDPR Article 28 before any such processing begins.
• SCC trigger: If personal data from the EU is shared with the US party, the parties agree to execute the appropriate 2021 SCCs module before any such transfer occurs.
• Breach notification: The receiving party must notify the disclosing party of any data breach involving shared personal data within 24 hours of discovering the breach.
• Data minimization: Personal data shared under the NDA will be limited to what is necessary for the stated purpose.

At Lopes Law LLC, we draft and review GDPR-compliant NDAs and DPAs for international business transactions, including franchise-related agreements.

How Does GDPR Affect Franchise Agreements with EU Franchisees?

US franchisors entering European markets face a specific set of GDPR challenges that domestic franchise agreements are not designed to address. The typical US franchise agreement assumes that data processed through the franchise technology platform (point-of-sale systems, customer loyalty programs, online ordering platforms) is handled under a single US law framework. In the EU, that assumption does not hold.

US franchisors with EU franchisees are generally controllers of the personal data of EU franchise customers when they control the technology platform processing that data. The EU franchisee may be a joint controller or a processor, depending on how much independence the franchisee has in determining data processing purposes. A franchise agreement that does not address this creates ambiguity about who bears GDPR compliance responsibility when a data subject rights request or a breach occurs.

The franchise agreement must: address GDPR compliance allocation, include or reference a DPA between the franchisor (as controller) and franchisee (as processor or joint controller), incorporate the applicable 2021 SCCs for data transfers from the EU franchisee location to US franchisor systems, and specify how data subject rights requests are handled across the franchisor-franchisee relationship.

Franchisors entering EU markets for the first time should have their standard FDD and franchise agreement reviewed for GDPR compliance before beginning any EU franchise sales. At Lopes Law LLC, we review franchise agreements for EU market readiness as part of our international franchisor services.

A Real Scenario: GDPR Compliance Failure in an EU Franchise Launch

A US food service franchisor began selling franchises in Portugal through a Portuguese master franchisor without updating their standard franchise agreement for GDPR. The franchise agreement specified that franchisees must use the US franchisor’s point-of-sale and customer loyalty platform, which collected customer names, email addresses, purchase histories, and location data.

When Portuguese franchise customers began submitting data deletion requests under GDPR Article 17, the US franchisor’s technology platform had no deletion workflow for EU customer data. The Portuguese data protection authority, the CNPD (Comissao Nacional de Protecao de Dados), received complaints and initiated an inquiry. The franchise agreement did not allocate GDPR compliance responsibility between the US franchisor and the Portuguese master franchisee.

The result was a dispute between the franchisor and master franchisee about who was responsible for implementing the deletion workflow, building the GDPR compliance framework, and bearing the costs of doing so. Neither party had planned or budgeted for this. At Lopes Law LLC, this scenario is exactly what our pre-launch EU franchise agreement review is designed to prevent. The cost of review is small compared to the cost of regulatory inquiry and franchisor-franchisee disputes.

What Is the EU-US Data Privacy Framework?

The EU-US Data Privacy Framework (DPF) was adopted in July 2023 following the invalidation of Privacy Shield by the European Court of Justice in 2020 (Schrems II decision). The DPF allows US companies that certify under the framework to receive EU personal data without using SCCs. Certification requires registering with the US Department of Commerce and committing to comply with DPF data protection principles.

Even with DPF certification, contracts with EU counterparties should still explicitly address data processing roles and responsibilities. DPF certification changes the transfer mechanism (no SCCs needed) but does not change the requirement for a DPA if you are processing EU personal data on behalf of an EU controller. DPF certification also does not protect against all enforcement risk: if your data practices do not match your DPF commitments, enforcement can come from the US Federal Trade Commission (FTC) as well as from EU data protection authorities.

The practical recommendation for most US businesses entering EU partnerships or franchise relationships is to use both DPF certification (if eligible) and SCCs as a backup, combined with a well-drafted DPA. This belt-and-suspenders approach reduces risk in the event DPF is challenged in court, which has happened with every predecessor framework.

DPF certification costs are relatively modest: there is no government filing fee, but the Department of Commerce requires the certifying company to maintain a publicly available privacy policy that meets DPF requirements, designate an independent dispute resolution body (annual cost typically $500 to $3,000 depending on the provider), and verify compliance annually. For US franchise companies with EU operations, the investment in DPF certification is proportionate to the compliance benefit it provides. At Lopes Law LLC, we advise US businesses on whether DPF certification is appropriate for their specific EU data transfer needs.

For broader context on cross-border confidentiality agreements, see our guide on Cross-Border NDAs and CDAs: What US Businesses Need to Know. For guidance on why bilingual legal review is important for Portuguese-language contracts with EU partners, see Why Your International Contract Needs a Bilingual Attorney, Not a Translator. For international investors entering the US franchise market, see our guide on International Franchise Investment in the US: A Legal Guide for Foreign Nationals.

Reach out, we are friendly. Call now for a free consultation at (267) 777-9117 or schedule your free 20-minute consultation online.