June 2026 Article 27 GDPR applies to far more US life sciences companies than many realise Intro The extraterritorial reach of the General Data Protection Regulation (GDPR) is well known, yet many US pharma and biotech companies are surprised to learn that it applies to them, and even more surprised to learn about Article 27. If your organisation has no establishment in the EU but engages with EU based consumers, patients or trial participants, you are likely required to a

May 2026 Intro The extraterritorial reach of the General Data Protection Regulation (GDPR) continues to capture organisations operating outside the European Union. While many recognise that the GDPR may apply to their activities, a critical obligation is often overlooked: the requirement to appoint an EU Data Representative under Article 27. This provision ensures that EU regulators and individuals have an accessible point of contact, reinforcing the GDPR’s core principles o