If your US small business sells products or services to customers in the European Union, you are subject to the General Data Protection Regulation (GDPR) regardless of where your company is located. GDPR applies to any organization that processes personal data of EU residents in connection with offering goods or services or monitoring their behavior. This means if you have EU customers, accept payments from EU visitors, or track EU users with analytics, you need to comply.
What Qualifies as Personal Data Under GDPR?
GDPR defines personal data broadly: any information relating to an identified or identifiable natural person. This includes names, email addresses, IP addresses, device identifiers, location data, online identifiers like cookies, and even behavioral data collected through analytics tools. If you collect email addresses for marketing, process payment information, or use tracking pixels on your website, you are processing personal data.
Many US small businesses underestimate their exposure. Even a simple newsletter signup form or a Google Analytics installation can trigger GDPR obligations if EU visitors interact with your site.
Core GDPR Requirements for US Small Businesses
Lawful Basis for Processing
You must have a legal justification for processing personal data. The most common lawful bases for small businesses are:
- Consent: Freely given, specific, informed, and unambiguous agreement from the individual. Pre-checked boxes do not qualify.
- Contract: Processing is necessary to fulfill a contract with the customer (e.g., shipping a product they ordered).
- Legitimate interests: You have a legitimate business reason that does not override the individual's privacy rights (e.g., fraud prevention).
You cannot simply assume consent. If you rely on consent, you must be able to prove the individual opted in, and they must be able to withdraw consent easily.
Transparency and Privacy Notices
You must provide clear information about what data you collect, why you collect it, how long you keep it, who you share it with, and what rights individuals have. This typically takes the form of a privacy policy that is:
- Written in plain language, not legal jargon
- Easily accessible from your homepage and at the point of data collection
- Specific about third-party services (e.g., payment processors, email marketing platforms, analytics tools)
Many small businesses use generic privacy policy templates that fail to accurately describe their actual data practices. This creates both legal risk and a credibility problem if regulators or customers investigate.
Individual Rights
GDPR grants EU residents specific rights over their data:
- Right of access: Individuals can request a copy of all personal data you hold about them.
- Right to rectification: They can ask you to correct inaccurate data.
- Right to erasure ("right to be forgotten"): In certain circumstances, they can demand deletion of their data.
- Right to data portability: They can request their data in a machine-readable format.
- Right to object: They can object to processing based on legitimate interests or for direct marketing.
You must respond to these requests within 30 days. Small businesses often lack the systems to efficiently locate and export customer data across multiple platforms (e.g., CRM, email marketing, analytics, support tickets).
Data Security Measures
GDPR requires "appropriate technical and organizational measures" to protect personal data. While the regulation does not prescribe specific technologies, you are expected to implement security proportionate to the risk. This typically includes:
- Encryption of data in transit (HTTPS) and at rest
- Access controls and authentication (strong passwords, multi-factor authentication)
- Regular security updates and patch management
- Vendor security assessments for third-party processors
- Incident response procedures
The security landscape in late 2024 underscores why these measures matter. This week alone, CISA flagged actively exploited vulnerabilities in Collabora Online and Arista VeloCloud Orchestrator, while Quest Diagnostics confirmed a data breach exposing patient records. Breaches involving EU customer data trigger mandatory notification requirements under GDPR.
Breach Notification Requirements
If you experience a data breach that poses a risk to individuals' rights and freedoms, you must notify the relevant EU supervisory authority within 72 hours of becoming aware of the breach. If the breach poses a high risk, you must also notify affected individuals without undue delay.
This is a significant operational burden for small businesses without dedicated security or legal teams. Many organizations discover breaches weeks or months after they occur, making the 72-hour window challenging.
Data Processing Agreements
If you use third-party vendors that process EU customer data on your behalf (e.g., cloud hosting providers, email marketing platforms, payment processors), you must have written Data Processing Agreements (DPAs) in place. These agreements specify the vendor's obligations regarding data security, confidentiality, and handling of data subject requests.
Most reputable SaaS vendors offer standard DPAs, but you need to actively execute them. Simply using a service does not automatically establish the required contractual protections.
Do You Need a Data Protection Officer?
Most US small businesses do not need to appoint a formal Data Protection Officer (DPO). GDPR requires a DPO only if your core activities involve large-scale systematic monitoring or processing of sensitive data categories (health data, biometric data, etc.). However, you should designate someone internally to own GDPR compliance, even informally.
What About International Data Transfers?
When you collect data from EU customers and store it on US servers, you are performing an international data transfer. Following the invalidation of Privacy Shield, the primary mechanisms for lawful transfers are:
- Standard Contractual Clauses (SCCs): Pre-approved contract templates from the European Commission that impose data protection obligations on the US recipient.
- Adequacy decisions: The EU-US Data Privacy Framework (approved in 2023) allows certified US companies to receive EU data, but small businesses must actively self-certify and pay annual fees.
Many small businesses overlook this requirement entirely, creating significant legal exposure.
Enforcement and Penalties: Real Risk for US Companies
GDPR fines can reach €20 million or 4% of global annual revenue, whichever is higher. While regulators have focused enforcement on large tech companies, supervisory authorities increasingly target smaller organizations, especially after data breaches.
US companies are not exempt. EU regulators can pursue enforcement through mutual legal assistance treaties, and EU customers can file complaints with their local data protection authority. Even if direct enforcement is difficult, GDPR violations create reputational damage and can derail partnerships with EU-based businesses that require vendor compliance.
Common GDPR Mistakes by US Small Businesses
- Assuming GDPR does not apply because the company is US-based
- Using pre-checked consent boxes or bundled consent for multiple purposes
- Failing to update privacy policies when adding new tools or services
- Not maintaining records of data processing activities
- Ignoring data subject access requests or responding too slowly
- Lacking DPAs with key vendors
- Not testing breach response procedures before an incident occurs
Practical Steps to Achieve GDPR Compliance
- Audit your data flows: Document what personal data you collect, where it is stored, who has access, and what third parties process it.
- Update your privacy policy: Make it specific, accurate, and accessible. Include details about cookies, analytics, and all third-party services.
- Implement consent mechanisms: Use clear opt-in checkboxes and maintain records of consent.
- Execute DPAs: Review your vendor contracts and ensure DPAs are in place for all processors.
- Establish a data subject request process: Create a workflow for handling access, deletion, and portability requests within 30 days.
- Review data security: Conduct a security assessment, implement encryption, enable MFA, and establish a patch management process. Given the critical vulnerabilities actively exploited this week, staying current on patches is not optional.
- Prepare for breach response: Draft notification templates and identify your primary supervisory authority in the EU.
- Consider legal advice: For complex situations or high-risk processing, consult with a lawyer experienced in EU data protection law.
How Much Does GDPR Compliance Cost?
Costs vary widely based on business size and complexity. Expect to invest:
- Legal review and policy drafting: $2,000–$10,000 for initial setup
- Privacy management tools: $50–$500/month for consent management platforms or data mapping tools
- Security improvements: Variable, depending on current state
- Ongoing compliance: 10–40 hours per year for policy updates, request handling, and vendor management
For many small businesses, the largest cost is time rather than money—understanding requirements, implementing processes, and maintaining documentation.
If you are navigating GDPR compliance and need help assessing your data security posture or implementing technical controls, Vici Tech Solutions can help with security assessments and secure architecture design.