This question is inspired by this other question asks about how a (fictional) Small Town News USA Inc could prepare for GDPR.

Although opportunistic lawsuits against US-based businesses on their handling of EU-residents data might be possible, I find it doubtful that EU would audit businesses outside their jurisdiction for GDPR compliance.

This is why I wanted to ask:

  1. Is it actually necessary for businesses (such as a Small Town News USA Inc) that do not reside in EU to care about GDPR?
  2. If it is then how (and by whom) would compliance be audited and/or enforced?
up vote 3 down vote accepted

Is it actually necessary for businesses (such as a Small Town News USA Inc) that do not reside in EU to care about GDPR?

Only if they offer goods/services to or monitor behavior of people in the EU (Art. 3(2)).

Note that:

having a commerce-oriented website that is accessible to EU residents does not by itself constitute offering goods or services in the EU. Rather, a business must show intent to draw EU customers, for example, by using a local language or currency.


If it is then how (and by whom) would compliance be audited and/or enforced?

Supervisory Authorities will care of it.

  • So it would be enough to have site in English? (A local language in still-in-EU-GB) – 9ilsdx 9rvj 0lo May 25 at 11:25
  • @9ilsdx9rvj0lo English is way too global language to hint applicable territory. Using currency (e.g. dollars vs pounds) would be way more effective. Or just explicitly say in which countries the business is done. – Greendrake May 25 at 11:35

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.