GDPR Goes Live May 25, 2018: What U.S. Small Businesses Actually Need to Know

On May 25, 2018, the European Union's General Data Protection Regulation — the most significant overhaul of data privacy law in 20 years — officially takes effect. The regulation has generated an enormous amount of coverage, alarm, and confusion. Here is what U.S. small businesses actually need to understand before the deadline.

The First Question: Does GDPR Apply to Your Business?

Many U.S. business owners assume GDPR is a European problem. That assumption is wrong. GDPR applies to any organization, anywhere in the world, that processes personal data of EU residents. If any of the following apply to your business, GDPR potentially covers you:

• Your website is accessible in EU countries and you collect email addresses, contact form submissions, or analytics data from EU visitors
• You use Google Analytics, Facebook Pixel, or any marketing pixel — these collect data from EU visitors automatically
• You sell products or services to EU residents, even occasionally
• You have employees, contractors, or partners located in EU countries
• You run email marketing campaigns that include EU-based subscribers

What GDPR Actually Requires: The Core Obligations

Lawful Basis for Processing Personal Data

Under GDPR, you must have a documented lawful basis for every type of personal data you collect. For most small businesses, the relevant bases are consent (for marketing emails) and contract performance (for customer data needed to deliver a service). Critical change: consent must be freely given, specific, informed, and unambiguous. Pre-checked boxes and vague "I agree to terms" checkboxes do not qualify.

Individual Rights That Must Be Honored

• Right to access: EU residents can request a copy of all personal data you hold about them — you must respond within 30 days
• Right to erasure: Individuals can request deletion of their data when they withdraw marketing consent
• Right to data portability: Individuals can request their data in a machine-readable format
• Right to object: Individuals can object to direct marketing processing, and you must stop immediately
• Right to rectification: Individuals can request correction of inaccurate data you hold

Data Breach Notification: The 72-Hour Clock

GDPR introduces mandatory breach notification timelines significantly stricter than U.S. norms. If a breach is likely to result in risk to individuals, you must notify the relevant EU supervisory authority within 72 hours of becoming aware of it. For high-risk breaches, you must also notify affected individuals directly. Most U.S. breach notification laws allow 30–60 days. GDPR gives you 72 hours.

Practical Compliance Steps for U.S. Small Businesses

1. 1Audit what personal data you collect: List every place you collect personal data — contact forms, email newsletters, CRM, e-commerce, analytics. For each, identify what is collected and why.
2. 2Update your privacy policy: Clearly explain what data you collect, why, how long you retain it, and what rights individuals have. Generic template policies from years ago will not meet GDPR standards.
3. 3Review your email marketing consent: EU subscribers must have given explicit consent to receive marketing. Imported lists, purchased lists, or lists built through pre-checked opt-in boxes are not compliant.
4. 4Add a cookie consent mechanism: If your site uses Google Analytics or any tracking cookies, EU visitors must be informed and given a choice before cookies are set.
5. 5Check your data processors: GDPR requires Data Processing Agreements with third-party services that handle personal data on your behalf (Mailchimp, HubSpot, Salesforce, etc.). Most major platforms have updated agreements — you may need to actively accept them.
6. 6Create a process for data subject requests: If an EU resident requests their data or asks to be deleted, you must respond within 30 days. Know where your data lives and how to retrieve or delete specific records.

The IT Infrastructure Implications of GDPR

• Data minimization: Collect only personal data strictly necessary for the stated purpose
• Encryption at rest and in transit: GDPR does not explicitly mandate encryption, but it is a recognized baseline technical measure
• Access controls: Only individuals who need access to personal data for their specific role should have it
• Data retention and deletion: You need the technical ability to actually delete a specific individual's data across all your systems when legally required
• Audit logging: The ability to demonstrate what happened to personal data — who accessed it, when it was modified, when it was deleted

What Are the Penalties — and Are They Realistic for Small U.S. Businesses?

GDPR penalties reach up to €20 million or 4% of global annual turnover for the most serious violations. For a small U.S. business with minimal EU exposure, the realistic enforcement risk is low — EU data protection authorities tend to prioritize large-scale violations. The greater risk for small U.S. businesses is reputational: a data breach combined with evidence of poor data governance can damage client trust in ways that are difficult to recover from.