Back to News

Why Your Small U.S. Business Should Care About GDPR

Published on

March 19, 2018

You’re not alone if your small business hasn’t been paying close attention to the fact that the General Data Protection Regulation (GDPR) goes live May 25. You may think the new European standard for cybersecurity doesn’t apply to you because you don’t do enough business in Europe to fall under the new regulation. Maybe you think your business is too small to be affected by the new regulation.

Maybe you’re wrong?

GDPR is the European Union’s (EU’s) sweeping and comprehensive data security regulation. Its primary goal is to create more consistent protection of consumer and personal data across all EU nations. The bad news for businesses is that GDPR’s requirements are strict. Stricter, in fact, than the already strict patchwork of U.S. data security laws and regulations. GDPR’s definition of “personal data” is much broader than the one we often use under U.S. laws and regulations and includes IP addresses, social media handles and other pieces of information that a business might collect about a person. It also provides EU citizens and residents a “right to erasure” and “data portability” – meaning that a person has a right to have their personal data completely eliminated or transmitted to another controller. GDPR violations can be steep – up to $20 million. The real intimidating news for U.S. businesses is that GDPR’s jurisdiction extends well beyond the borders of the EU and allows both its citizens (wherever residing) and its residents to pursue legal action against violating businesses even if those businesses are outside of Europe.

How does a U.S. business determine if the GDPR applies to them? Start by conducting a data security risk assessment – one that includes an evaluation of whether your business is regularly marketing to or doing business with customers who have some connection to the EU. Review your business’s web presence and determine if your business is monitoring and collecting IP addresses of those using your website. Pay particular attention if those IP addresses originate in the EU. If your business is doing any of these things, it could be violating GDPR. The bottom line is that your business needs to become familiar with GDPR regulation and its requirements.

It will certainly be interesting to observe the nature and breadth of enforcement actions U.S. businesses may see under GDPR, as each EU country is going to be able to enforce GDPR on behalf of its own citizens. Ultimately, advance preparation will be key for U.S. businesses looking to steer clear of enforcement actions.If you have any questions about GDPR, please reach out to me.


Related News

View More News
Press Release
February 6, 2023

Barley Snyder Partner Donald Geiter Receives CIPM Certification

For Immediate Release Lancaster, Pa. – Barley Snyder partner Donald R. Ge...

Learn More
Press Release
January 23, 2023

Barley Snyder Adds Attorney Jacob Kiessling in Harrisburg

For Immediate Release Harrisburg, Pa. – Barley Snyder is pleased to ...

Learn More
Press Release
January 20, 2023

Barley Snyder Announces 2023 Leadership Changes

For Immediate Release Lancaster, Pa. – Barley Snyder has announced severa...

Learn More

Other Upcoming Events

View All Upcoming Events
Mar
07
7:30 am
-
11:00 am
event
Location

2023 Transportation, Logistics & Trade Seminar

Learn More
Mar
23
12:00 pm
-
6:00 pm
event
Location

LendiCon 2023

Learn More
May
12
event
Location

40th Annual Employment Law Seminar

Learn More

Get in Touch

Our attorneys, paralegals and staff look forward to hearing from you. Please reach out to let us know how we can help.

Get In Touch
RECOGNIZED IN
Super Lawyers
Best Law Firms US News
Best Lawyers