By the Integrated Business Systems engineering team · Last updated 27 October 2026
The GDPR applies to processing of personal data in the context of an establishment in the EU, which includes an EU office or subsidiary. It can also apply to companies outside the EU that offer goods or services to people in the EU or monitor their behaviour. If you employ staff in Europe, you process their personal data, so the GDPR almost certainly applies to that office. The UK has its own version, the UK GDPR.
GDPR requires security "appropriate to the risk". For most offices, that means:
Fines can reach €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious infringements.
When EU personal data is accessed from or transferred to the US, a transfer mechanism is needed. Options include the EU–US Data Privacy Framework (for certified US companies) and Standard Contractual Clauses. Your IT provider should be able to explain how its own access to your systems is covered.
US companies sometimes think of GDPR as a customer-data issue. Your European employees' HR records, emails, device logs and access history are personal data too, and they have rights over it, including access requests. Your IT setup should let you find, export and, where appropriate, delete one person's data across email, files and HR systems.
Tools such as Microsoft Purview eDiscovery can make the search much faster.
The GDPR requires notifying the relevant supervisory authority within 72 hours of becoming aware of a breach that is likely to result in a risk to people's rights and freedoms, and informing affected people where the risk is high. That deadline is only realistic if logging is already on and someone knows who decides. Write the decision tree before you need it.
Having an establishment such as an office in the EU generally brings its processing within scope, whatever the size.
Only in certain cases, such as large-scale monitoring or processing special categories of data. Your advisers can confirm.
Yes, with a valid transfer mechanism and appropriate security. See the transfers section above.
We run IT for the London offices of US and international companies: helpdesk, Microsoft 365 security, office networks and backups, under the same SLA as your other offices. Monitoring never switches off, and a vetted London field partner takes care of anything physical.
Many US companies run their European operations from Dublin. We run IT for those offices: helpdesk, Microsoft 365 security, networks and backups, under the same SLA as your US sites. We watch your systems day and night and send a vetted Dublin engineer when something needs a physical fix.
We run IT for the Amsterdam offices and European headquarters of US and international companies: helpdesk, Microsoft 365 security, networks and backups, in English and under one SLA. Systems are monitored continuously, and local field partners we've vetted cover on-site jobs around the Randstad.
We run IT for the Barcelona offices of US and international companies: helpdesk, Microsoft 365 security, office networks and backups, under one English-language SLA. Our engineers monitor your systems around the clock, and vetted local partners handle anything that needs hands on site.
Book a free 60-minute IT review.
Book a free 60-minute IT review →