Selling online to EU countries: does GDPR directly apply to us?

European data protection authorities aren't going to come after a small Russian workshop with millions of euros in fines let's be realistic. The real risk is international payment processors or integrations freezing your account over user complaints. Their own terms of service mandate GDPR compliance.

If you use Google Analytics or ad pixels, turn on IP anonymization settings. Also, your cookie banner can't just be an "I Accept" button; users must be able to reject analytics and marketing cookies separately.

Add a clickable checkbox or note at checkout stating: "Your data is processed in accordance with our privacy policy for order fulfillment and delivery." Make sure your policy clearly lists a contact email for data deletion requests.

Back when our EU sales were around 4,500 EUR a month, a customer from Germany sent a formal email asking which servers held their data and demanding its deletion. You are legally required to reply in writing within 30 days. We wiped the records from our database, confirmed it with them, and that was that.

Is having an English version and showing prices in euros enough on its own or does an actual order have to be delivered there?

It is worth noting that cross-border data processing exceeding certain volumes requires appointing an EU Representative. However, the principle of proportionality applies to micro-enterprises, making basic transparency and data security measures the primary focus of enforcement.

dont panic at all. major lawsuits only target massive platforms. just dont collect anything beyond the name and address needed to ship the order post a clear policy, and if a customer asks for deletion do it without making a fuss. for an SME, thats basically it.

Saved.

Thanks for writing this that's the right way... An automated scan report is not the same as a penetration test.

Let me share my experience. The answer varies greatly by industry; there is no one-size-fits-all rule.

This is my opinion, I'm not claiming it's absolute truth.

Good call starting this thread. Payment information changes are never verified through the channel they came from.

Good luck with that.

Following.

Thanks for posting. Just because everyone does it doesn't mean it's right.

Hope this helps.

This is exactly what we experienced. Security isn't absolute; it's about making attacks not worth the effort.

That's all, sorry if I went on too long.

Let me write how it's done in practice. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

If you post the result here, it will help others too.

This approach has a cost, which isn't discussed. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

This is my opinion, I'm not claiming it's absolute truth.

I'll try it.

Let me summarize the topic, since several different answers were given. Mistakes made on the gdpr side are usually reversible but expensive.

If you scold false alarms, nobody will report again.