GDPR Basics for Small Businesses With Customers Abroad

GDPR can apply even if you are not in Europe

The General Data Protection Regulation (GDPR) is the EU's personal-data protection law, and it has applied since May 2018. A business located outside the EU can still fall under it when it offers goods or services to people in the EU, or monitors their behavior. If you are a solo operator or small company selling to customers abroad, it is worth checking once.

What follows is general information. Whether the rule covers your business, and how much work it requires, depends on your facts. Please consult a lawyer who knows data protection law before making decisions.

Does it apply to you?

The key question is whether you are directing your business at people in the EU. A site in one language that happens to receive an occasional order from Europe is not clearly covered. These signs make it more likely that you are targeting EU customers:

• The site is offered in EU languages.
• Prices appear in euros and you advertise shipping to EU countries.
• You run ads or pages clearly aimed at customers in the EU.

Analytics or advertising tags that track the behavior of people in the EU can also be relevant. "Personal data" is a broad term. Besides names and email addresses, it can include IP addresses and cookie identifiers.

The core ideas

GDPR asks organizations that handle personal data to follow these principles:

• Lawful basis: you need a recognized reason to process data, such as consent, performance of a contract, a legal obligation, or a legitimate interest.
• Purpose limits and minimization: decide why you collect data and collect only what you need.
• Transparency: tell people in plain language what you collect, why, who receives it, and how long you keep it.
• Individual rights: people can ask to see, correct, delete, or receive a copy of their data.
• Security and breach handling: in many cases a breach must be reported to the supervisory authority within 72 hours of becoming aware of it.

The maximum fine for the most serious violations is 20 million euros or 4 percent of worldwide annual turnover, whichever is higher. That is a ceiling, and actual penalties depend on the case.

What a small business can check

Sorting out your situation before you talk to a professional makes the conversation shorter.

Start with these six checks.

1. Inventory: what personal data do your order forms, contact forms, mailing list, and analytics collect?
2. Recipients: which outside services hold that data, such as payment, shipping, email, and analytics tools?
3. Privacy policy: does it state purposes, retention periods, and a contact point?
4. Consent: can people choose, for email marketing and cookies?
5. Requests: who handles a request to view or delete data, and how?
6. Incidents: what is the contact procedure if data leaks?

A business outside the EU that is covered may need to appoint a representative inside the EU. Smaller organizations get relief from some record-keeping duties, but with exceptions, so do not rely on that without advice.

Your home country's law still applies

Data protection laws elsewhere, including Japan's Act on the Protection of Personal Information, are separate from GDPR. Meeting one does not mean you meet the other. Review both.

Keep the work proportionate. A small shop usually does not need an elaborate program. It needs an accurate picture of what data it holds, a policy that matches what it really does, and a person who knows what to do when someone asks to delete their data. A professional can tell you which of these gaps matter for your situation and which can wait.

When you meet a professional, bring a single page that summarizes your business, what you sell, where your customers live, and the names of the outside services you use. It speeds up the review and keeps the conversation on your actual situation.

What to do next

1. Check whether you have EU customers, using your site languages, currencies, and shipping destinations.
2. List the personal data you collect and the outside services that hold it.
3. Reread your privacy policy for purposes, retention periods, and a contact point.
4. Take the list and the policy to a data-protection professional.
5. Write a one-page procedure naming who handles deletion and access requests.