GDPR for Massachusetts Companies: When It Applies

GDPR for Massachusetts companies comes down to one test: the EU regulation applies to a business with no EU establishment when it offers goods or services to people in the EU, or monitors their behavior there. If either is true, the company needs a lawful basis for processing, appropriate security, and usually a designated EU representative.

Plenty of Massachusetts firms meet that test without having thought of themselves as international: a software company with a handful of German customers, a clinic network running analytics on visitors from Ireland, a consumer brand shipping to France. The good news is that a company already maintaining a written information security program under Massachusetts law has a head start on the security side.

When does GDPR for Massachusetts companies apply?

Article 3(2) of the General Data Protection Regulation says it applies to "the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union," where the processing relates to "the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union" or "the monitoring of their behaviour as far as their behaviour takes place within the Union."

The European Data Protection Board calls this the targeting criterion. Free services count, since payment is not required. Its guidelines also note that a website being accessible from the EU does not, on its own, give a company an establishment in the EU.

The practical question for an operator is whether the business deliberately serves or tracks people in the EU. Selling into EU markets, running EU-targeted campaigns, or profiling EU visitors through analytics all point toward yes. That is a data governance question first, which is where data governance: where to start comes in: you cannot answer it without knowing whose data you hold and why.

Does a Massachusetts company need an EU representative?

Usually, if Article 3(2) applies. Article 27 says "the controller or the processor shall designate in writing a representative in the Union." The EDPB's guidelines state that a company required to designate one and failing to do so would be in breach of the Regulation.

There is a narrow exemption for processing that is occasional, does not involve large-scale special-category or criminal data, and is unlikely to result in a risk to people's rights. Public authorities are also exempt. Designating a representative does not shield the company itself from legal action; Article 27(5) says so directly.

The exemption is worth reading carefully before relying on it. The EDPB's territorial scope guidelines treat processing as occasional only if it is not carried out regularly and falls outside the regular course of business, which rules out a business with regular EU customers.

How large can GDPR fines be?

Article 83 sets two tiers. The lower tier, under Article 83(4), is up to EUR 10 million or, for an undertaking, up to 2% of total worldwide annual turnover for the preceding financial year, whichever is higher. It covers obligations including Articles 25 to 39, which includes the Article 32 security requirement and the Article 27 representative requirement.

The upper tier is up to EUR 20 million or 4% of worldwide turnover, whichever is higher. It covers the core principles, legal bases for processing, consent, data subject rights, and international transfers. The EDPB's guidelines on calculating fines confirm both tiers.

Those are ceilings. For a company preparing for investment or acquisition, the more immediate point is that GDPR exposure is part of what a buyer will examine, as covered in breach due diligence before investing.

Can a Massachusetts company still transfer EU data under the Data Privacy Framework?

Yes, as of publication. The European Commission adopted the EU-US Data Privacy Framework adequacy decision on July 10, 2023. US organizations join by self-certifying to the Department of Commerce and must re-certify annually, and the FTC notes that failing to comply may violate Section 5 of the FTC Act.

The framework has survived its first court test. On September 3, 2025, the EU General Court dismissed the Latombe challenge, finding that the United States ensured an adequate level of protection when the decision was adopted. Latombe lodged an appeal with the Court of Justice on October 31, 2025, as Case C-703/25 P.

Separately, after the US Supreme Court decided Trump v. Slaughter on June 29, 2026, the European Data Protection Board wrote on July 31, 2026 asking the Commission to closely assess whether the ruling affects the framework, noting that the adequacy decision refers to the independence of US authorities including the FTC. The framework remains in force, but it is under review. A sensible step is to ask counsel whether a fallback transfer mechanism should be ready.

How does 201 CMR 17.00 compare with GDPR Article 32?

Massachusetts does not yet have a comprehensive consumer privacy law. The Massachusetts Data Privacy Act, S.2619, passed the Senate 40-0 on September 25, 2025, and an amended House version passed 146-0 on June 4, 2026. The bill has been in conference committee since June 2026, and as of October 13, 2026 no final bill had been enacted.

What Massachusetts does have is 201 CMR 17.00, the data security regulation behind the Massachusetts WISP requirements. Reading it beside GDPR Article 32 shows real overlap. Both are risk-based and proportional: Article 32 asks for measures "appropriate to the risk," considering the state of the art, cost, and the nature of the processing, while 201 CMR 17.03(1) asks for safeguards appropriate to the size, scope, and type of business, its resources, the amount of data stored, and the need for confidentiality. Both name encryption, and both require evaluating whether the safeguards work.

The differences are just as clear in the texts. 201 CMR 17.00 requires a written program and names specific controls: secure authentication, access restrictions, encryption on public networks and laptops, firewalls, patches, malware protection, and employee training. Article 32 is less prescriptive but adds availability, resilience, and the ability to restore data in a timely manner after an incident. Neither text says that complying with one satisfies the other, so treat a WISP as a strong starting point for GDPR security work and plan the rest separately.

The work that serves both is the same: know where personal data lives, who can reach it, and which vendors process it. The sub-processor problem and flowing down security obligations cover the vendor side, data you don't keep can't leak covers minimization, and Massachusetts data breach notification requirements covers what happens when something goes wrong.

At Kief Studio we build systems where the data inventory, access controls, and vendor boundaries are part of the platform itself, so data governance is something the system does rather than a document written afterward. The consulting page covers how to reach us about scoping that work. Brian Gagne leads the security engineering, and briansgagne.com goes deeper on the technical controls. MyRHC offers a structured compliance assessment. This is general information, not legal advice.

Related reading

• Massachusetts WISP requirements under 201 CMR 17
• Data governance: where to start
• The sub-processor problem
• Breach due diligence before investing

Frequently Asked Questions

Does GDPR apply to a US company with no EU office?

It can. Under Article 3(2), GDPR applies to a controller or processor outside the EU when it offers goods or services to people in the EU, paid or free, or monitors their behavior in the EU.

Do Massachusetts companies need an EU representative under GDPR?

Usually, if Article 3(2) applies. Article 27 requires a written designation of a representative in the EU, with a narrow exemption for occasional, low-risk processing that does not involve large-scale sensitive data.

What are the maximum GDPR fines?

Up to EUR 10 million or 2% of worldwide annual turnover for obligations such as security, and up to EUR 20 million or 4% for principles, legal bases, data subject rights, and transfers, whichever is higher in each case.

Does Massachusetts have a comprehensive privacy law?

Not as of October 13, 2026. S.2619 passed both chambers in different versions and is in conference committee. 201 CMR 17.00 covers data security, not comprehensive privacy rights.

Is the EU-US Data Privacy Framework still valid?

Yes, as of publication. The General Court upheld it in September 2025, an appeal was lodged in October 2025, and the EDPB has asked the Commission to assess the effect of Trump v. Slaughter.