A common pattern: the founder is in the UK, the company is incorporated in Delaware, and the users are everywhere. Privacy law follows where the business operates and whose data it handles. The place of incorporation matters much less.
Which laws apply
UK. The UK GDPR applies to processing in the context of an establishment in the UK, and a business run from the UK can have one even if the company is foreign. It also applies to offering services to people in the UK.
EU. The GDPR applies to a business with no EU presence if it offers services to individuals in the EU. That business will usually need an EU representative. A data intermediary must appoint a legal representative under the Data Governance Act as well.
US. Privacy law is state by state, with thresholds. California’s CCPA applies to businesses above set revenue or data-volume levels. A pre-revenue start-up may fall below them at first, but the rules on authorised agents still govern requests it makes for consumers. Several states also require data brokers to register.
Moving the data
The EU renewed its adequacy decisions for the UK in December 2025, so data can flow from the EU to the UK. Transfers from the UK or EU to a US company need a mechanism: certification under the Data Privacy Framework, or standard contractual terms with a transfer risk assessment. A US parent holding the central database is making those transfers every day.
Which entity holds the data
Decide early which company is the controller for which users. A UK or EU subsidiary acting as controller for European users can simplify both regulation and transfers. Investors may still expect a Delaware parent. Tax will have its own view.
Draw the map before building the product. Retrofitting corporate structure around a live database is slow and expensive.
This article is general information on the law as at October 2026. It is not legal advice and has not been updated since that date. See the terms of use.