Which regulation requires US companies that process the data of EU citizens to comply?

• A. General Data Protection Regulation (GDPR)
• B. California Consumer Privacy Act (CCPA)
• C. CAN-SPAM Act
• D. App Tracking Transparency (ATT)

Answer: (A)

The main idea here is how data protection rules can reach beyond borders. The General Data Protection Regulation (GDPR) applies to the processing of personal data of individuals in the European Union, no matter where the company doing the processing is located. That means a US company must comply with GDPR when it handles EU residents’ data, if its activities relate to offering goods or services to them or monitoring their behavior in the EU. This extraterritorial reach is what makes GDPR the correct choice for a US company processing EU citizens’ data.

For context, GDPR sets broad requirements about lawful bases for processing, transparency, data subject rights, data minimization, security, and cross-border transfers, along with consequences for noncompliance. The other options don’t capture this EU-wide, cross-border scope: a California privacy law focuses on residents of California, a CAN-SPAM Act targets commercial email practices, and App Tracking Transparency governs opt-in tracking on Apple devices.