GDPR
General Data Protection Regulation — an EU law (2018) governing the collection and processing of personal data. Applies to any company serving EU citizens. Fines up to €20M or 4% of revenue.
In practice
GDPR applies to you even if you're a company based outside the EU, as long as you have European customers. In practice, you need: (1) a cookie consent banner, (2) a detailed privacy policy, (3) a way to 'delete my data,' (4) documentation of who accesses data and why.
Common misconception
'GDPR isn't relevant outside Europe.' That's a mistake. If you sell to Europe (Germany, France, the Netherlands...), GDPR applies. The country's Data Protection Authority can fine even a non-EU company. Fines of $5,500+ on small stores have already happened.
How to fix it
Not sure if you're GDPR compliant? (1) Use a GDPR checklist (iubenda.com/en/help/12088), (2) add a cookie consent banner (Cookiebot, OneTrust — the free tier suffices for small stores), (3) update your privacy policy with GDPR clauses, (4) set up a data-deletion process for customer requests.
Example
An Israeli clothing store selling to Germany received a letter from a German DPA about a missing cookie banner. They fixed it with a free Cookiebot setup and a privacy policy update — under 10 hours of work, avoiding a potential €5,000 fine.
Priority
Check GDPR compliance before launching sales to Europe. Three minimum actions: cookie banner, privacy policy, and a data-deletion option. Expensive legal counsel isn't necessary for small stores — Cookiebot plus a GDPR generator is enough to start.
Related terms
Keep learning. Metrics that touch the same area:
- Privacy PolicyLegalA document on the site explaining what data is collected, how it's used, who it's shared with, and users' rights. Legally required in Israel (Privacy Protection Law), under GDPR, and under CCPA.
- Terms of ServiceLegalThe contract between merchant and customer: return policy, product warranty, payment terms, liability limits, jurisdiction. Consumer protection laws set minimum requirements.
Jimmy tracks your GDPR, automatically
WhatsApp alerts when something important changes. No dashboards, no hassle.