“We’re not based in the EU, so European regulations don’t apply to us.” Many companies still make this assumption when expanding into Europe. But today, where your company is located is only part… | EDPO (European Data Protection Office)

View organization page for EDPO (European Data Protection Office)

EDPO (European Data Protection Office)

81,057 followers

1mo

“We’re not based in the EU, so European regulations don’t apply to us.” Many companies still make this assumption when expanding into Europe. But today, where your company is located is only part of the equation. European regulations increasingly look at your activities, the services you provide, and the users you reach. The GDPR was only the starting point. Depending on your business model, other frameworks may also apply, from the Digital Services Act to more specific sector regulations. The challenge is not knowing that regulations exist. It is understanding which ones apply to your organisation. At EDPO, we help organisations understand their representative obligations and navigate the requirements that come with operating in the European market. Because accessing the European market means looking beyond borders.

Transcript

There's a lot to think about when scaling into Europe. Back in 2018, of course, GDPR became applicable and companies suddenly add another legislation and other European regulatory framework they had to worry about. And with that came all the obligations that the GDPR implies. But as these companies now know, there's actually way more to comply than the GDPR. So if you're a digital service provider, you need to be looking not only at how you're processing data under the GDPR. All the obligations that come with it, but also, for example, under the Digital Services Act, do you have your transparency reporting invoice? For example, if you're on an online platform, are you complying with your Digital Services Act obligations? It may also be that you also have to comply with other legislation such as a regulation on addressing the dissemination of terrorist content online. All very niche, very specific, but all things that people need to actually worry about. And it's easy to think that, ohh, this does not apply to me. Because we are not in the European Union, we are not established there, but actually there is an extraterritorial scope to to many of, if not almost all of the legislations nowadays. So if they're offering their services in the European Union, they need to worry about being compliant with them. And it doesn't stop there really. So I've mentioned GDPR, I've mentioned the Digital Services Act, but there's also, for example, the very well known AI Act, so for mainly providers of general purpose AI models. And providers of Iris Ki systems, they need to really pay attention to a lot of the obligations under the AI Act. Then NISU is also a big one that we've been seeing. Many companies have been contacting us about this directive. And then of course, the most recent one, the Data Act. So companies that are involved in the Internet of Things or providing services that are connected to the Internet of Things, they need to also comply with the Data Act and all the obligations that come with it there. Are more legislation, of course there are a lot of them, but just in in this short amount of time you already can tell I guess that if you're a company outside of EU but you're offering your services in the EU, you are probably looking at a dozen legislations from the get go that you have to be compliant with and it can be quite difficult sometimes the common thing with all these legislations that I've been mentioning is that they have an obligation to appoint a representative and that's something that EPO does and the point is we. Try to make at least that one obligation much simpler so that companies can then kick start things from there.

To view or add a comment, sign in

More Relevant Posts

EDPO (European Data Protection Office)

81,057 followers
2mo
Report this post
Regulation of the digital space is accelerating, and it’s not just about rules on paper. The European Commission is driving proposals that quickly become applicable, aiming to make online environments safer and more accountable. From the Digital Services Act tackling illegal content and disinformation, particularly during sensitive moments like elections, to emerging frameworks shaping digital operations, the trend is clear: digital spaces are being regulated to protect users and trust. At EDPO, we help organisations with their representative needs under legislations such as the Digital Services Act. #EDPO #DigitalRegulation #DSA #OnlineSafety #EUCompliance #DataProtection #ResponsiblePlatforms
Like Comment
To view or add a comment, sign in
EDPO (European Data Protection Office)

81,057 followers
4mo
Report this post
Digital evidence is becoming central to investigations, from online threats to fraud. The EU e-Evidence package gives authorities structured, faster access to that data, while keeping fundamental rights like data protection intact. For non-EU companies, the representative becomes the key contact for authorities, ensuring accountability and compliance. At EDPO, we help organisations put this into practice. Representation isn’t just a formality, it’s operational, practical, and essential. #EDPO #EUCompliance #DigitalRegulation #DataProtection #eEvidence #RepresentativeRole
Like Comment
To view or add a comment, sign in
EDPO (European Data Protection Office)

81,057 followers
3mo
Report this post
Think your one-person startup is too small for GDPR? Think again. It’s not your headcount that matters, it’s whether you handle European personal data. From solo founders to enterprises with 10,000+ employees, GDPR applies across the board. Ignoring it isn’t just risky, it can block deals, partnerships, and trust with customers. At EDPO, we guide companies of every size to stay compliant, accountable, and reachable across the EU. Compliance isn’t optional, it’s operational. Curious how your business fits? Let’s talk. #EDPO #GDPR #EUCompliance #DataProtection #SmallBusinessCompliance
Like Comment
To view or add a comment, sign in
EDPO (European Data Protection Office)

81,057 followers
10mo
Report this post
An elevator pitch… in an actual elevator. We couldn’t resist. In 20 seconds, Diego covers something most companies outside Europe still underestimate: how many EU, UK and Swiss laws now require a representative. GDPR, UK GDPR, Swiss FADP, DSA, AI Act, NIS2, Data Act, DGA, TCOR… (and the list isn’t getting shorter). So if you ever find yourself stuck in an elevator with us, this is exactly what we’ll explain. Minus the floor buttons. 🎥 Watch Diego’s (literally) elevated pitch. #EDPO #GDPR #AIAct #DSA #EUCompliance #RegTech #ElevatorPitch
Like Comment
To view or add a comment, sign in
EDPO (European Data Protection Office)

81,057 followers
3mo
Report this post
Cybersecurity isn’t optional. And under NIS2, it’s not just about systems, it’s about responsibility. The NIS2 Directive strengthens protection for critical infrastructure and digital services, with clear rules on risk management and incident reporting. As your representative under Article 26(3), we are the point of contact with EU authorities and CSIRTs, helping you meet reporting obligations, and avoid fines or personal liability for board members. NIS2 compliance starts with having the right structure in place. That’s where EDPO comes in. #EDPO #NIS2 #Cybersecurity #EUCompliance #DigitalRegulation #DataProtection #RepresentativeServices
Like Comment
To view or add a comment, sign in
EDPO (European Data Protection Office)

81,057 followers
3mo
Report this post
Last week, EDPO was in Vienna for the International Data Law Forum (IDLF). From emerging AI governance challenges to the resilience of cybersecurity frameworks, we saw how theory meets practice. Discussions on cross-border investigations, AI explainability, and preparing for future risks (yes, even quantum computing!) reinforced that compliance isn’t just about ticking boxes. Next year, we’ll continue the conversation in Lisbon, already looking forward to it! #EDPO #IDLF2026 #DataProtection #AIRegulation #Cybersecurity #DigitalCompliance #OperationalTrust
Like Comment
To view or add a comment, sign in
EDPO (European Data Protection Office)

81,057 followers
5mo
Report this post
Just back from Dublin, where the IAPP AI Governance Global Europe 2026 brought together privacy, legal, and AI professionals for two intense days of discussions. The big takeaway? Responsible AI isn’t just compliance, it’s about trust, accountability, and making AI work in practice. From agentic AI to GDPR alignment, from human oversight to third-party risk, the conversations were rich, practical, and energising. This is what responsible AI governance looks like when you’re in the room where it happens. #IAPPAIGG26 #ResponsibleAI #AIGovernance #DataProtection #EDPO

1 Comment
Like Comment
To view or add a comment, sign in
EDPO (European Data Protection Office)

81,057 followers
4mo
Report this post
One of the biggest misconceptions around representation is thinking it comes after expansion. It doesn’t. Under several frameworks such as the AI Act, the representative is not an optional administrative step added later. It’s part of the conditions for operating in the market. In some cases, legislation explicitly states that the competent authority needs to be notified of the legal representative before a company is entitled to provide specific services (e.g. in the Data Governance Act). Which changes the perspective entirely. Representation is not something you “fix later”. It’s part of the structure that needs to exist from day one so authorities and individuals have a local point of contact from the moment services become available.
Like Comment
To view or add a comment, sign in
EDPO (European Data Protection Office)

81,057 followers
8mo
Report this post
What a week it was! Two days filled with incredible insights, deep discussions, and dynamic networking at the IAPP UK Intensive 2026 in London. We dove into exciting conversations around AI, cybersecurity, and data protection, and walked away with new perspectives on the evolving regulatory landscape. Here are some key takeaways that stood out: 🎯 AI governance is more than a buzzword - it’s a strategic differentiator. 🎯 AI risks are multiplying, from generative concerns to misaligned actions and accountability gaps. 🎯 Cyber resilience remains the bedrock of organisational security. 🎯 DSARs are becoming a key strategic focus. 🎯 And, of course, age assurance and children’s privacy are top of mind for regulators worldwide. The energy was electric, the debates were thought-provoking, and the networking? Next level! Check out our aftermovie to get a glimpse of the action - we’re already excited for what next year holds!
Like Comment
To view or add a comment, sign in
EDPO (European Data Protection Office)

81,057 followers
1mo
Report this post
One global strategy. Multiple regulatory realities. As companies expand into new markets, one challenge quickly becomes clear: regulatory frameworks may share common principles, but they are rarely identical. The GDPR has influenced data protection laws around the world, including Brazil’s LGPD. But each jurisdiction has developed its own requirements and specificities. For international organisations, understanding these differences is essential. Because global compliance is not about applying one approach everywhere. It is about adapting to the rules that apply in each market. One common requirement across several jurisdictions: appointing a local representative. At EDPO, we provide representative services in the EU, UK, Switzerland and Monaco to help organisations meet these local obligations.
Like Comment
To view or add a comment, sign in

81,057 followers

View Profile Follow

More from this author

Explore content categories