# What is GDPR?

What is GDPR? General Data Protection Regulation — an EU law (2018) governing the collection and processing of personal data.

## How it works in practice

GDPR applies to you even if you're a company based outside the EU, as long as you have European customers. In practice, you need: (1) a cookie consent banner, (2) a detailed privacy policy, (3) a way to 'delete my data,' (4) documentation of who accesses data and why.

## Related metrics

- Privacy Policy — a GDPR compliance document
- Cookie Consent — a direct GDPR requirement
- Data Breach Notification — mandatory within 72 hours
- Third-Party Data — GDPR restricts its use

## Common misconception

'GDPR isn't relevant outside Europe.' That's a mistake. If you sell to Europe (Germany, France, the Netherlands...), GDPR applies. The country's Data Protection Authority can fine even a non-EU company. Fines of $5,500+ on small stores have already happened.

## How to fix it

Not sure if you're GDPR compliant? (1) Use a GDPR checklist (iubenda.com/en/help/12088), (2) add a cookie consent banner (Cookiebot, OneTrust — the free tier suffices for small stores), (3) update your privacy policy with GDPR clauses, (4) set up a data-deletion process for customer requests.

## Real-world example

An Israeli clothing store selling to Germany received a letter from a German DPA about a missing cookie banner. They fixed it with a free Cookiebot setup and a privacy policy update — under 10 hours of work, avoiding a potential €5,000 fine.

## Where to start

Check GDPR compliance before launching sales to Europe. Three minimum actions: cookie banner, privacy policy, and a data-deletion option. Expensive legal counsel isn't necessary for small stores — Cookiebot plus a GDPR generator is enough to start.

---

Category: Legal · From the [Jimmy OS KPI Glossary](https://jimmy-os.com/glossary/kpi.md) · Source page: https://jimmy-os.com/glossary/kpi/gdpr