Short answer: GDPR can apply to a studio outside the EU, but an EU passport on your class list is not what triggers it. Under Article 3(2) it applies when you offer your classes to people who are in the EU (online classes sold to European customers, a retreat priced in euros, a website aimed at EU countries) or monitor their behaviour online. A tourist who drops in while on holiday in your city is, on its own, rarely enough. If you are in scope, you need a GDPR-grade privacy notice, data processing agreements with your vendors, a clear picture of where they store data and, unless your EU processing is only occasional, an EU representative.
"Does GDPR apply to us? We're not even in the EU."
It is a fair question for a studio in Manchester, Toronto or Austin, and the internet tends to answer it in one of two unhelpful ways: "GDPR applies the moment one EU resident books a class", or "it's an EU law, so it's not your problem". Both are wrong often enough to matter.
The real test is about what you offer and to whom, not about your customers' passports. This guide covers when GDPR reaches a studio outside the EU, what changes if it does, and what is sensible to do either way. It is written for studios in the UK, the US and Canada, but the logic holds wherever you are. If your studio is inside the EU or the EEA, start with our practical GDPR guide for fitness studios instead.
This is general information, not legal advice. If a question matters for your business, check with a data protection lawyer or the relevant authority.
When does GDPR apply to a studio outside the EU?
Article 3(1) of the GDPR covers businesses with an establishment in the EU, such as a studio, branch or staff based in an EU country. Article 3(2) is the route that reaches studios with no EU presence at all. It applies when you process personal data of people who are in the EU and the processing relates to either:
- offering them goods or services, paid or free (Article 3(2)(a)), or
- monitoring their behaviour, as far as that behaviour takes place in the EU (Article 3(2)(b)).
"In the EU" means where the person is, not their nationality. The European Data Protection Board (EDPB), which brings together the EU's data protection authorities, says in its guidelines on territorial scope (Guidelines 3/2018) that what counts is where the person is when you offer the service or monitor them. A French citizen living in Toronto is not "in the EU" for this purpose. A Canadian on a gap year in Lisbon is.
Offering means targeting, not just being reachable. Recital 23 of the GDPR says that a website that can be opened from the EU, an email address or the language of your own country is not enough on its own. Targeting shows in things you do on purpose: prices in euros, a site in an EU language not commonly used where you are, an EU country domain, ads aimed at EU countries, or a page that mentions your customers in the EU.
Typical studio scenarios
Authorities look at the whole picture case by case, so read this table as a way of thinking, not a verdict.
| Scenario | Under GDPR? | Why |
|---|---|---|
| A German tourist walks into your Austin studio and buys a drop-in at the desk | Generally no | She is not in the EU when you sell her the class, and you are not targeting the EU. |
| A Dutch visitor books from Amsterdam before her trip, on your English-language site aimed at locals, paying in dollars | Grey area, leaning no | Being bookable from the EU is not targeting by itself. That changes if you start marketing to EU visitors. |
| You sell livestream or on-demand classes, and a growing group of subscribers in Ireland and Germany pay in euros | Likely yes | You offer a service to people in the EU, and the euro pricing shows you mean to. |
| Your London studio advertises a summer retreat on social media to audiences in Ireland and the Netherlands | Likely yes | Ads aimed at specific EU countries are a clear sign of targeting. |
| Your website runs retargeting ads or tracking that builds profiles of visitors, including visitors in the EU | Possibly, as monitoring | The EDPB counts behavioural tracking and profiling as monitoring. Plain visitor statistics are less clear. |
When Article 3(2) applies, it covers the data of the people you target in the EU, not automatically your whole member list. In practice most studios run one set of routines for everyone anyway, because two privacy regimes in one booking system is more trouble than it is worth.
UK, US and Canada: how GDPR sits next to your own rules
United Kingdom
Since Brexit the UK has its own regime: the UK GDPR together with the Data Protection Act 2018, supervised by the Information Commissioner's Office (ICO). It applies to everything a UK studio does, and because it started from the EU text, the day-to-day obligations look familiar. EU GDPR comes on top only when you target people in the EU. The practical additions are then mainly an EU representative (unless your EU processing is occasional), naming that representative in your privacy notice, and accepting that EU authorities, not just the ICO, can act on complaints from your EU customers.
United States
There is no single federal privacy law comparable to GDPR. A growing number of states have their own consumer privacy laws, often with thresholds a small studio will not meet, so check your state. GDPR is a separate question: a studio in Austin that sells online classes to customers in Germany can be under GDPR even if no US privacy law applies to it. If you target customers in the UK, the UK GDPR has a parallel rule, including its own UK representative requirement.
Canada
Private-sector privacy is governed by PIPEDA at federal level and by provincial laws in some provinces, including Quebec's Law 25. The EU recognises Canada as adequate for commercial organisations subject to PIPEDA, which makes it easier for EU businesses to send data to you. It does not switch off Article 3(2): if you target customers in the EU, GDPR applies to that processing.
Do you need an EU representative?
If Article 3(2) applies to you, Article 27 requires you to designate, in writing, a representative in one of the EU countries where your customers are. The representative is the contact point for customers and authorities, but does not take over your responsibility: you are still the one who has to comply.
The exception covers processing that is occasional, does not include large-scale processing of special categories of data such as health data (Article 9) or data on criminal offences, and is unlikely to result in a risk to people's rights and freedoms. All three conditions must be met.
| Your situation | EU representative? |
|---|---|
| A handful of EU bookings a year, no health information stored | The exception will often fit, if you are in scope at all |
| Online classes or retreats sold to EU customers on a regular basis | Hard to rely on the exception: the processing is not occasional |
| Health questionnaires or injury notes kept for EU customers as routine | Be careful: health data is a special category, and routine processing is not occasional |
Representatives are usually appointed through a law firm or a specialised service; agree the mandate in writing and put their contact details in your privacy notice (Article 13). Note also that a representative does not give you the GDPR's one-stop shop, according to the EDPB: without an EU establishment, the authority in each EU country where your customers are can deal with complaints about you.
Data transfers: where does your data actually live?
A customer giving you her data is not a "transfer". When someone in the EU fills in your booking form, the EDPB treats it as collection directly from the person, not as a transfer under the GDPR's third-country rules (Guidelines 05/2021). Your obligations come from Article 3(2).
What happens to the data afterwards is where it gets technical. If GDPR applies to you and you pass EU customers' data on to vendors (booking system, email platform, payment processor, cloud storage), you need a data processing agreement with each of them (Article 28), and your privacy notice has to say whether data leaves the EU and on what basis (Article 13). The bases you will meet:
- Adequacy decisions. The European Commission has recognised a number of countries as offering adequate protection, among them the UK, Switzerland, Canada (commercial organisations), Japan, South Korea, New Zealand, Israel, Argentina and Uruguay. These decisions are reviewed over time, so check the Commission's current list.
- The EU-US Data Privacy Framework. Since July 2023 there has been an adequacy decision for the US, but it only covers US companies that have self-certified. You can look a vendor up on the official Data Privacy Framework list.
- Standard contractual clauses (SCCs). For other destinations, the usual tool is the Commission's standard contractual clauses, often built into a vendor's DPA. Since the Schrems II judgment of July 2020, which struck down the previous EU-US Privacy Shield, SCCs must be paired with an assessment of the law in the destination country and, where needed, extra safeguards.
The Data Privacy Framework is the third EU-US arrangement: its two predecessors were struck down by the EU Court of Justice, and the current one has also been challenged. Vendors that keep data in the EU or another adequate country are less exposed if it falls. Ask each vendor three questions: where is the data stored, which sub-processors do you use and where, and which transfer mechanism do you rely on? A serious vendor answers all three in its DPA or sub-processor list.
What to do in practice
Whether or not GDPR technically applies to you, most of this costs little and protects you either way.
- Decide whether you target the EU. Look at your website and marketing the way an authority would (euro prices, EU languages, ads aimed at EU countries). If you do target the EU, treat that part of the business as covered by GDPR.
- Map where member data lives: booking system, payment processor, email and SMS tools, accounting, the spreadsheet on the front-desk laptop, instructors' phones.
- Get a data processing agreement from every vendor that handles member data (Article 28), and note where each stores data and on what transfer basis.
- Write a plain-language privacy notice: who you are, what you collect and why, the legal basis per purpose, recipients, whether data leaves the EU, retention, people's rights and their right to complain to an authority. Add your EU representative if you have one.
- Use the right legal basis for each purpose. Bookings rest on the contract, accounting records on a legal obligation, newsletters typically on consent. One "I agree to the terms" tick box does not cover all of them.
- Be careful with health data. Injury notes, pregnancy information and health questionnaires are special category data (Article 9). Collect only what instructors need; for a studio this usually means explicit consent.
- Have a routine for requests for access, correction, deletion or a portable copy. Answer without undue delay and within one month, extendable by two months for complex requests.
- Write a one-page breach plan. If a breach is likely to put people at risk, the competent authority must be notified within 72 hours (Article 33). Without an EU establishment that can mean the authority in each EU country where affected customers live. Log every breach, including the ones you do not report.
- Keep a simple record of processing (Article 30). The exemption for organisations with fewer than 250 employees does not cover routine processing, so a studio with a booking system should assume it needs one. A page is usually enough.
Where Class Booking fits
Class Booking is built in Denmark by Nahbo ApS, so GDPR is home turf for us rather than an add-on. Studio data is hosted in the EU. Your studio remains the data controller and we act as your processor under a data processing agreement available to every customer (read about our DPA). Our sub-processors and their locations are listed in our privacy policy, including which ones rely on the Data Privacy Framework.
That covers the booking system's part of your map. What you collect, on which legal basis and whether you target the EU remain your decisions.
Frequently asked questions
Does GDPR apply to a yoga studio in the US?
Only if it offers its services to people who are in the EU or monitors their behaviour online (Article 3(2)). Online classes or retreats sold to European customers, euro pricing and EU-targeted ads point towards yes; tourists who drop in usually do not.
Does one EU customer mean GDPR applies?
Not on its own. What matters is whether you target people in the EU, not whether an EU citizen ends up on your list. A single tourist booking is a grey area at most; a steady flow of EU customers you actively sell to is a different matter.
Does a small studio need an EU representative?
If GDPR applies through Article 3(2), yes, unless your processing is occasional, involves no large-scale health or criminal-offence data and is unlikely to create a risk for people (Article 27). Studios that regularly sell to EU customers generally cannot rely on that exception.
Is the UK still covered by GDPR after Brexit?
The UK has its own UK GDPR and the Data Protection Act 2018, supervised by the ICO. EU GDPR applies to a UK studio in addition only when it targets people in the EU.
Can I use US software for EU customers' data?
Yes, with a valid basis: the vendor is certified under the EU-US Data Privacy Framework, or you rely on standard contractual clauses plus a transfer assessment. Either way you also need a data processing agreement. Keeping the data in the EU or another adequate country is the simplest route.
A booking system with EU hosting and a DPA for every customer
Drop-ins, class packs, memberships and payments by card, Apple Pay and Google Pay via Stripe, with studio data hosted in the EU. From €10 / £8 / $13 a month, free for 14 days, no card needed.
Try free for 14 days →