The General Data Protection Regulation (GDPR) is European law, but it was written to reach beyond Europe. If you sell online, you may have customers there without ever planning to.
When GDPR can apply to you
GDPR can apply to an organisation outside the EU in two main situations: when it offers goods or services to people in the EU, or when it monitors the behaviour of people in the EU, such as tracking them online. Simply having a website that someone in Europe could open is generally not enough. What counts is whether you are targeting people there, for example by pricing in euros, shipping to EU countries or marketing in local languages.
The UK has its own version
Since Brexit the United Kingdom has its own UK GDPR, which works in a very similar way for people in the UK.
How it differs from the Australian rules
- GDPR has no small business turnover exemption in the way the Privacy Act historically has
- It requires a lawful basis for processing, such as consent or contract
- People have stronger rights, including erasure and data portability
- Fines for the most serious breaches can reach up to 20 million euros or 4 percent of worldwide annual turnover, whichever is higher
A sensible approach for small exporters
If you knowingly sell to the EU or UK, get specific advice. If you do not, make sure nothing on your site suggests you do, and keep your privacy policy and cookie practices tidy. Good Australian privacy practice is a strong foundation either way.
What to do this week
- Check your analytics for traffic and customers from the EU and UK
- Review whether your pricing, shipping or marketing targets those regions
- If it does, book a short consult with a privacy lawyer
This is general information, not legal advice. If you are unsure how this applies to your business, speak with a qualified privacy lawyer and see the OAIC guidance.