Get your CPA firm aquainted with new FTC rules. In 2018, the European Union enacted a sweeping new data privacy law called the General Data Protection Regulation (GDPR). The GDPR governs how businesses collect, use, protect, and share the personal data of EU citizens, giving users unprecedented rights over their information.
But it’s not only applicable to European companies. If your company has European customers, the regulations also apply to you. While the GDPR is an EU regulation, its impact has been global. The law applies to any company operating in the EU or handling data from EU residents—regardless of where the business is headquartered. U.S. companies like Google, Facebook, and Amazon have all had to significantly rework their data practices to comply.
GDPR’s strict rules around user consent, data rights, and potential penalties raise the stakes for businesses of all sizes that collect or use any personal data tied to EU residents. For small and mid-sized businesses, getting GDPR-ready is now table stakes for building consumer trust and avoiding crippling fines.
At its core, the GDPR aims to give individuals more control over how their personal data is collected, used, and shared by companies.
AI and GDPR
Beyond just data privacy, GDPR also has implications for artificial intelligence and automated decision-making systems. Article 22 gives individuals the right not to be subject to decisions based solely on automated processing, including profiling, if those decisions produce legal or similarly significant effects.
If businesses do use algorithms or AI models to make impactful decisions about individuals—like loan eligibility, hiring, insurance pricing and more—GDPR requires that they provide clear explanations of the logic involved and allow individuals to contest the outcome. There must be human involvement and oversight for high-stakes automated decisions.
The “right to explanation” codified in GDPR pushes back against the “black box” problem in AI, where the decision-making process of complex algorithms can be opaque even to their creators. Any small business deploying AI or automated decision models needs to have processes for making those systems auditable, interpretable, and explainable on demand to affected individuals under GDPR.
Here are some of the key requirements of GDPR that small businesses need to understand:
User Consent is Everything
Under GDPR, businesses must get explicit, affirmative consent from users before collecting or using their personal data in any way—no more pre-checked boxes or implied consent allowed. Privacy policies and data collection notices must be clear, understandable, and spell out exactly what data will be collected and how it will be used. Users must be able to withdraw consent just as easily as they gave it.
Those ubiquitous cookie consent banners and pop-ups on websites? You can thank GDPR’s stringent consent rules for those.
Broad Definition of Personal Data
The GDPR takes an expansive view of what constitutes “personal data” that is subject to regulation. Article 9 of the GDPR goes far beyond obvious identifiers like names, emails, and physical addresses to include:
- Demographics
- Web behaviors and tracking data
- IP addresses
- Information relating to a person’s sex life, political views, religious beliefs, racial/ethnic identity, genetic data, biometric data, and health information
Any data that could directly or indirectly identify an individual falls under GDPR’s purview.
User Control and Rights
Perhaps the biggest shift ushered in by GDPR is the idea that personal data “belongs” to the individual, not the business that collects it. GDPR enshrines several rights designed to give users more transparency and control, including:
- The right to access their data and receive a copy
- The right to have personal data rectified if inaccurate
- The right to have data deleted (“right to be forgotten”)
- The right to object to automated decision-making and profiling
- The right to explanation about how data is processed
Businesses must have processes to fulfill these rights on request. Privacy policies must disclose what data is collected, why it’s needed, how long it will be kept, if/how it will be shared, and who to contact with questions or requests.
High Stakes for Non-Compliance
Regulators can levy heavy fines of up to €20 million or 4% of a company’s global annual revenue (whichever is higher) for GDPR violations like failing to get proper user consent, inadequate data security measures, or improper data transfers across borders.
But penalties go beyond just monetary fines. Under GDPR, authorities can restrict data processing activities or even ban a company from operating in the EU entirely if they fail to properly protect user data.
Public scrutiny and backlash are other risks, as GDPR violations are often highly publicized. In 2022, Meta (Facebook’s parent company) was fined over $400 million for failing to properly disclose how user data is used for targeted advertising.
Even for companies not headquartered in the EU, getting GDPR compliance wrong can mean being locked out of a massive market over data issues. That makes GDPR readiness critical for any business hoping to tap into European customers or audiences.
How Small Businesses Outside the EU Can Comply
If your small business has any EU users, website visitors, employees, vendors or partners, you are subject to GDPR’s requirements around that data. Even businesses located entirely outside the EU need to have a GDPR compliance plan if they meet that criteria.
A few key steps for small businesses looking to get GDPR-compliant:
- Audit your data collection and processing activities. Map out what personal data you collect from EU residents, including through cookies or other online tracking, and inventory how that data flows through your systems. This will help identify GDPR compliance gaps.
- Update your privacy policies and notices with GDPR-mandated disclosures about data practices. Make sure to obtain proper consent (no more pre-checked boxes!) and provide opt-out mechanisms.
- Put procedures in place for honoring user data rights like access requests or data deletion. Ensure your tech stack is set up to enable these capabilities.
- Review data security programs and have a plan for reporting any breaches within the required 72-hour window under GDPR.
- For businesses outside the EU, determine if you need to appoint a Data Protection Officer (required if processing a large amount of personal data).
- Provide GDPR training for employees who have access to or process personal data of EU residents.
GDPR set a new bar for data privacy that goes beyond legal requirements. Any business that handles personal data, EU-based or not, should see GDPR as an opportunity to boost consumer trust. Getting it right demonstrates a real commitment to safeguarding users’ most sensitive information.
While GDPR compliance is an upfront investment, the costs of non-compliance are just too high. As other countries like the U.S. push ahead with their own data privacy regulations, GDPR readiness will only become more important for businesses of all sizes. For small companies looking to compete in today’s data economy, prioritizing GDPR compliance isn’t just the ethical choice—it’s a matter of sheer survival.
