GDPR for US Multinationals
Overview
General Data Protection Regulation (EU) 2016/679 applies to US companies when they offer goods/services to EU/EEA data subjects or monitor their behavior—regardless of US headquarters. Agent/LLM systems processing EU user prompts, support chat, or analytics fall in scope.
| GDPR topic |
Article |
US multinational focus |
| Principles |
Art. 5 |
Lawfulness, minimization, storage limitation for agent logs |
| Lawful basis |
Art. 6 |
Consent vs legitimate interest for AI features |
| Special categories |
Art. 9 |
Health, biometric in prompts—explicit consent or Art. 9(2) exception |
| Records of processing |
Art. 30 |
RoPA must list LLM/MCP subprocessors and transfers |
| Security |
Art. 32 |
Encryption, redaction gate, MCP access controls |
| Breach notification |
Art. 33-34 |
72 hours to supervisory authority; data subject notice if high risk |
| DPIA |
Art. 35 |
Required for systematic profiling, large-scale special categories |
| Transfers |
Art. 44-49 |
SCCs, DPF, or adequacy for US LLM processing |
| DPO |
Art. 37-39 |
Required for large-scale special category or systematic monitoring |
| Rights |
Art. 15-22 |
Access, erasure, portability—LLM vendor deletion complexity |
Transfer mechanisms (2024+):
- EU-US Data Privacy Framework (DPF) — US entities self-certify; verify LLM vendor DPF status
- Standard Contractual Clauses (2021 SCCs) — Module 2 controller-processor for LLM vendors
- UK IDTA / Addendum — if UK data subjects included
Reference: references/gdpr-article-checklist.md, template templates/gdpr-ropa-template.yaml
When to Use
Use this skill when:
- US company processes EU/EEA (or UK) residents' personal data in products or agents
- Assessing cross-border transfers to US-based LLM APIs (OpenAI, Anthropic, etc.)
- Building Article 30 RoPA including agent/MCP processing activities
- DPIA for agent profiling, automated decisions, or health-related prompts
- 72-hour breach notification to lead supervisory authority (cross-border one-stop-shop)
- Drafting DPA/SCCs with LLM and MCP subprocessors
- DPO consultation on high-risk AI agent deployment in EU market
Do not use this skill when:
- US-only processing (use
us-state-privacy-laws, ccpa-cpra-privacy-rights)
- HIPAA-covered PHI for US treatment/payment (HIPAA may apply; GDPR may also apply for EU patients—dual track)
- FedRAMP/CMMC without EU data (use respective skills)
Core Process
Execute steps in order.
Step 1: Territorial scope and roles
- Confirm Art. 3 applicability: EU establishment, offering goods/services to EU, or monitoring behavior.
- Identify controller, joint controller, processor roles:
- US SaaS with EU customers → typically controller
- LLM API → processor (or subprocessor)
- Determine lead supervisory authority (Art. 56) if main establishment in EU; US-only establishment → identify EU member state of most data subjects or first contact.
- Artifact: scope JSON with establishment map.
Step 2: Lawful basis (Art. 6)
For each agent processing activity, document lawful basis:
| Activity |
Typical basis |
Notes |
| Customer support agent |
Contract Art. 6(1)(b) |
Necessary for service |
| Product analytics on prompts |
Legitimate interest Art. 6(1)(f) |
LIA required; opt-out where applicable |
| Marketing personalization agent |
Consent Art. 6(1)(a) |
Granular, withdrawable |
| Compliance audit agent |
Legal obligation Art. 6(1)(c) |
Document statute |
- Special category data (Art. 9) in prompts—health, biometric: explicit consent or documented Art. 9(2) exception; default deny without basis.
- Apply
redaction.py before US LLM transfer as technical minimization (Art. 5(1)(c)).
Step 3: Records of processing (Art. 30)
Populate templates/gdpr-ropa-template.yaml:
- Processing activity name (e.g., "EU Customer Support Agent")
- Purposes, categories of data subjects and personal data
- Recipients including US LLM subprocessors
- Transfers to third countries + safeguards (SCCs, DPF)
- Retention periods; security measures (Art. 32 cross-ref)
- Do not store raw special category data in RoPA—reference categories only.
Step 4: International transfers (Chapter V)
- Inventory transfers to US for LLM inference, logging, training:
- Vendor DPF certification status (DataPrivacyFramework.gov)
- If no DPF: execute 2021 SCCs Module 2 (controller-processor) + UK Addendum if needed
- Transfer impact assessment (TIA) for US surveillance laws post-Schrems II:
- Supplementary measures: encryption in transit, redaction, contractual audit, data residency EU region if offered
- MCP servers in US: document as subprocessor transfers.
Step 5: Data subject rights (Arts. 15-22)
| Right |
Agent/LLM implementation |
| Access Art. 15 |
Export prompts/logs; redact third-party PI |
| Erasure Art. 17 |
Delete from DB, vector store; vendor deletion SLA |
| Portability Art. 20 |
JSON export of agent session data |
| Object Art. 21 |
Stop profiling-based agent features |
| Restrict Art. 18 |
Flag account—no LLM processing pending review |
- One-month response (extendable 2 months)—stricter than many US states.
- Route DSARs without sending full request to US LLM unredacted.
Step 6: Security (Art. 32)
- Align with
hipaa-phi-redaction-pipeline and access-control-identity-audit where applicable.
- Document: pseudonymization (Presidio tokens), encryption, MCP OAuth, resilience testing.
- Deanonymization opt-in in
agent.py supports Art. 32 minimization—default redacted output.
Step 7: DPIA (Art. 35)
Required when processing likely high risk—systematic profiling, large-scale special categories, public monitoring:
- Describe agent processing, necessity, proportionality
- Risk to data subjects: incorrect automated decisions, US transfer exposure
- Mitigations: human review, redaction, EU region deployment, SCCs
- Consult DPO (Art. 35(2)); seek supervisory authority opinion if residual high risk (Art. 36)
Step 8: Breach notification (Arts. 33-34)
- 72 hours from awareness to supervisory authority—not 60 days like HIPAA.
- If high risk to individuals: communicate breach to data subjects without undue delay (Art. 34).
- Cross-border: notify lead authority; cooperate with concerned authorities (Art. 33(2)).
- Use
breach-incident-response for containment; this skill for GDPR clock and content.
- Document processor notification from LLM vendor (Art. 33(2) processor→controller without undue delay).
Step 9: Processor agreements (Art. 28)
LLM/MCP DPA must include:
- Subject matter, duration, nature/purpose, data types, controller instructions
- Confidentiality, security Art. 32, subprocessor authorization
- Assistance with DSAR, DPIA, breach notification
- Deletion/return at end of service
- Audit and inspection rights
Step 10: Documentation and accountability (Art. 5(2))
- Maintain RoPA, DPIA, LIA, SCCs, DPF certifications, training records.
- Evidence manifest with SHA-256 for audit readiness.
- Disclaim: operational readiness—not legal opinion; engage EU privacy counsel for binding interpretation.
Common Rationalizations
| Excuse |
Rebuttal |
| "We're US-only company—GDPR doesn't apply." |
Art. 3(2) applies if offering services to EU data subjects—SaaS with EU users triggers GDPR. |
| "LLM vendor handles GDPR—we're processor only." |
SaaS owner is usually controller for customer relationship—cannot outsource accountability. |
| "HIPAA compliance satisfies GDPR." |
GDPR has broader rights, 72-hour breach, DPIA, and transfer rules—separate program required. |
| "Redaction means no transfer of personal data." |
If re-identification possible or tokens map stored, still personal data—document transfer mechanism. |
| "SCCs alone are enough post-Schrems II." |
TIA + supplementary measures required—document encryption and access controls. |
Red Flags
- EU user prompts sent to US LLM without SCCs/DPF/TIA
- No RoPA entry for agent processing activities
- Art. 9 special category data in prompts without documented basis
- Breach response plan uses HIPAA 60-day timeline only
- No DPO involvement in agent DPIA despite profiling
- Deanonymization enabled by default in production EU path (violates minimization)
Verification
1---2name: gdpr-us-multinational3description: Implements GDPR compliance workflows for US-headquartered multinationals—EU/EEA/UK data subjects, Articles 5-7 lawful basis, Article 30 records of processing, Article 32 security, Articles 33-34 breach notification (72 hours), Article 35 DPIA, Standard Contractual Clauses, EU-US Data Privacy Framework adequacy, and DPA/subprocessor governance for agent/LLM cross-border transfers. Trigger when US companies process EU residents' data, deploying agents in EU regions, assessing LLM vendor international transfers, or preparing RoPA/DPIA for multinational privacy programs. Do not use for US state laws only (use us-state-privacy-laws or ccpa-cpra-privacy-rights), HIPAA PHI (use hipaa-technical-safeguards), or UK-only post-Brexit without EU scope (note UK GDPR parallels in references).4---56# GDPR for US Multinationals78## Overview910**General Data Protection Regulation (EU) 2016/679** applies to US companies when they **offer goods/services to EU/EEA data subjects** or **monitor their behavior**—regardless of US headquarters. Agent/LLM systems processing EU user prompts, support chat, or analytics fall in scope.1112| GDPR topic | Article | US multinational focus |13| --- | --- | --- |14| Principles | **Art. 5** | Lawfulness, minimization, storage limitation for agent logs |15| Lawful basis | **Art. 6** | Consent vs legitimate interest for AI features |16| Special categories | **Art. 9** | Health, biometric in prompts—explicit consent or Art. 9(2) exception |17| Records of processing | **Art. 30** | RoPA must list LLM/MCP subprocessors and transfers |18| Security | **Art. 32** | Encryption, redaction gate, MCP access controls |19| Breach notification | **Art. 33-34** | **72 hours** to supervisory authority; data subject notice if high risk |20| DPIA | **Art. 35** | Required for systematic profiling, large-scale special categories |21| Transfers | **Art. 44-49** | SCCs, DPF, or adequacy for US LLM processing |22| DPO | **Art. 37-39** | Required for large-scale special category or systematic monitoring |23| Rights | **Art. 15-22** | Access, erasure, portability—LLM vendor deletion complexity |2425**Transfer mechanisms (2024+):**2627- **EU-US Data Privacy Framework (DPF)** — US entities self-certify; verify LLM vendor DPF status28- **Standard Contractual Clauses (2021 SCCs)** — Module 2 controller-processor for LLM vendors29- **UK IDTA / Addendum** — if UK data subjects included3031Reference: `references/gdpr-article-checklist.md`, template `templates/gdpr-ropa-template.yaml`3233## When to Use3435Use this skill when:3637- US company processes **EU/EEA (or UK) residents'** personal data in products or agents38- Assessing **cross-border transfers** to US-based LLM APIs (OpenAI, Anthropic, etc.)39- Building **Article 30 RoPA** including agent/MCP processing activities40- **DPIA** for agent profiling, automated decisions, or health-related prompts41- **72-hour breach notification** to lead supervisory authority (cross-border one-stop-shop)42- Drafting **DPA/SCCs** with LLM and MCP subprocessors43- **DPO consultation** on high-risk AI agent deployment in EU market4445Do **not** use this skill when:4647- US-only processing (use `us-state-privacy-laws`, `ccpa-cpra-privacy-rights`)48- HIPAA-covered PHI for US treatment/payment (HIPAA may apply; GDPR may also apply for EU patients—dual track)49- FedRAMP/CMMC without EU data (use respective skills)5051## Core Process5253Execute steps **in order**.5455### Step 1: Territorial scope and roles56571. Confirm **Art. 3** applicability: EU establishment, offering goods/services to EU, or monitoring behavior.582. Identify **controller**, **joint controller**, **processor** roles:59 - US SaaS with EU customers → typically **controller**60 - LLM API → **processor** (or subprocessor)613. Determine **lead supervisory authority** (Art. 56) if main establishment in EU; US-only establishment → identify EU member state of most data subjects or first contact.624. Artifact: scope JSON with establishment map.6364### Step 2: Lawful basis (Art. 6)6566For each agent processing activity, document lawful basis:6768| Activity | Typical basis | Notes |69| --- | --- | --- |70| Customer support agent | Contract Art. 6(1)(b) | Necessary for service |71| Product analytics on prompts | Legitimate interest Art. 6(1)(f) | LIA required; opt-out where applicable |72| Marketing personalization agent | Consent Art. 6(1)(a) | Granular, withdrawable |73| Compliance audit agent | Legal obligation Art. 6(1)(c) | Document statute |74751. **Special category data (Art. 9)** in prompts—health, biometric: explicit consent or documented Art. 9(2) exception; default deny without basis.762. Apply `redaction.py` **before** US LLM transfer as technical minimization (Art. 5(1)(c)).7778### Step 3: Records of processing (Art. 30)7980Populate `templates/gdpr-ropa-template.yaml`:81821. Processing activity name (e.g., "EU Customer Support Agent")832. Purposes, categories of data subjects and personal data843. Recipients including **US LLM subprocessors**854. Transfers to third countries + safeguards (SCCs, DPF)865. Retention periods; security measures (Art. 32 cross-ref)876. **Do not** store raw special category data in RoPA—reference categories only.8889### Step 4: International transfers (Chapter V)90911. Inventory transfers to **US** for LLM inference, logging, training:92 - Vendor DPF certification status ([DataPrivacyFramework.gov](https://www.dataprivacyframework.gov/))93 - If no DPF: execute **2021 SCCs** Module 2 (controller-processor) + UK Addendum if needed942. **Transfer impact assessment (TIA)** for US surveillance laws post-Schrems II:95 - Supplementary measures: encryption in transit, redaction, contractual audit, data residency EU region if offered963. MCP servers in US: document as subprocessor transfers.9798### Step 5: Data subject rights (Arts. 15-22)99100| Right | Agent/LLM implementation |101| --- | --- |102| Access Art. 15 | Export prompts/logs; redact third-party PI |103| Erasure Art. 17 | Delete from DB, vector store; vendor deletion SLA |104| Portability Art. 20 | JSON export of agent session data |105| Object Art. 21 | Stop profiling-based agent features |106| Restrict Art. 18 | Flag account—no LLM processing pending review |1071081. **One-month** response (extendable 2 months)—stricter than many US states.1092. Route DSARs without sending full request to US LLM unredacted.110111### Step 6: Security (Art. 32)1121131. Align with `hipaa-phi-redaction-pipeline` and `access-control-identity-audit` where applicable.1142. Document: pseudonymization (Presidio tokens), encryption, MCP OAuth, resilience testing.1153. **Deanonymization opt-in** in `agent.py` supports Art. 32 minimization—default redacted output.116117### Step 7: DPIA (Art. 35)118119Required when processing likely **high risk**—systematic profiling, large-scale special categories, public monitoring:1201211. Describe agent processing, necessity, proportionality1222. Risk to data subjects: incorrect automated decisions, US transfer exposure1233. Mitigations: human review, redaction, EU region deployment, SCCs1244. Consult **DPO** (Art. 35(2)); seek supervisory authority opinion if residual high risk (Art. 36)125126### Step 8: Breach notification (Arts. 33-34)1271281. **72 hours** from awareness to supervisory authority—not 60 days like HIPAA.1292. If high risk to individuals: communicate breach to data subjects without undue delay (Art. 34).1303. Cross-border: notify **lead authority**; cooperate with concerned authorities (Art. 33(2)).1314. Use `breach-incident-response` for containment; this skill for **GDPR clock and content**.1325. Document processor notification from LLM vendor (Art. 33(2) processor→controller without undue delay).133134### Step 9: Processor agreements (Art. 28)135136LLM/MCP DPA must include:137138- Subject matter, duration, nature/purpose, data types, controller instructions139- Confidentiality, security Art. 32, subprocessor authorization140- Assistance with DSAR, DPIA, breach notification141- Deletion/return at end of service142- Audit and inspection rights143144### Step 10: Documentation and accountability (Art. 5(2))1451461. Maintain RoPA, DPIA, LIA, SCCs, DPF certifications, training records.1472. **Evidence manifest** with SHA-256 for audit readiness.1483. Disclaim: operational readiness—not legal opinion; engage EU privacy counsel for binding interpretation.149150## Common Rationalizations151152| Excuse | Rebuttal |153| --- | --- |154| "We're US-only company—GDPR doesn't apply." | **Art. 3(2)** applies if offering services to EU data subjects—SaaS with EU users triggers GDPR. |155| "LLM vendor handles GDPR—we're processor only." | SaaS owner is usually **controller** for customer relationship—cannot outsource accountability. |156| "HIPAA compliance satisfies GDPR." | GDPR has **broader rights**, 72-hour breach, DPIA, and transfer rules—separate program required. |157| "Redaction means no transfer of personal data." | If re-identification possible or tokens map stored, still personal data—document transfer mechanism. |158| "SCCs alone are enough post-Schrems II." | **TIA + supplementary measures** required—document encryption and access controls. |159160## Red Flags161162- EU user prompts sent to US LLM without SCCs/DPF/TIA163- No RoPA entry for agent processing activities164- Art. 9 special category data in prompts without documented basis165- Breach response plan uses HIPAA 60-day timeline only166- No DPO involvement in agent DPIA despite profiling167- Deanonymization enabled by default in production EU path (violates minimization)168169## Verification170171- [ ] Art. 3 applicability and controller/processor roles documented172- [ ] Lawful basis (and Art. 9 if applicable) for each agent activity173- [ ] Art. 30 RoPA populated including US transfers and subprocessors174- [ ] Transfer mechanism verified (DPF/SCCs) with TIA on file175- [ ] DSAR workflow meets one-month deadline with LLM vendor chain176- [ ] Art. 32 security measures mapped to technical controls177- [ ] DPIA completed for high-risk agent processing; DPO consulted178- [ ] 72-hour breach notification playbook integrated179- [ ] Art. 28 processor DPAs executed with LLM/MCP vendors
vaquarkhan