What is GDPR?

The General Data Protection Regulation (GDPR) is the European Union’s comprehensive data privacy and security framework. It regulates how personal information—ranging from names and email addresses to IP logs and financial records—is collected, stored, processed, and transferred.

As an EU-based entity, our operations are directly governed by the GDPR under Article 3(1) (the establishment criterion), which requires us to uphold strict data safeguards across all commercial operations.

How GDPR Applies to Non-EU Consumers

1. When an EU Company Handles Non-EU Consumer Data

When an EU-based business processes the personal data of customers located outside the EU, the EU establishment itself must adhere to core GDPR standards. Non-EU customers benefit from:

Lawful and transparent processing: Data is collected under explicit legal grounds (e.g., executing a purchase contract or fulfilling legal obligations).
Data minimisation: Only personal data strictly necessary to carry out trade transactions, customs clearance, and logistics is gathered.
Robust security standards: Data systems must maintain technical and organisational safeguards (e.g., encryption, access controls) regardless of where the customer resides.

2. When Non-EU Businesses Target EU Markets

Under Article 3(2) (the extra-territorial effect), non-EU businesses are legally bound by GDPR if they:

Offer goods or services to individuals located within the EU (e.g., accepting Euros, offering EU shipping, or localising websites for EU member states).
Monitor the online behaviour of users in the EU (e.g., through tracking cookies or targeted marketing campaigns)

Key Compliance Requirements

Requirement	What It Means for Non-EU Trade
Breach Notification	Significant personal data breaches must be reported to the competent supervisory authority within 72 hours of awareness.
EU Representative (Article 27)	Non-EU companies targeting EU markets without an EU branch must appoint a designated representative within an EU member state.
Consumer Data Rights	Consumers maintain fundamental rights, including the right to access their data, correct inaccuracies, or request deletion ("right to be forgotten").
Cross-Border Data Transfers	Exporting personal data outside the European Economic Area (EEA) requires approved safeguard mechanisms—such as an Adequacy Decision, Standard Contractual Clauses (SCCs), or Binding Corporate Rules.
Lawful Basis & Consent	Every instance of data collection requires a valid legal ground (contract performance, explicit consent, or legitimate interest). Pre-ticked consent boxes are invalid.

WHY US?

Established by British entrepreneurs, EUify is an EU trade and management consultancy based in The Hague, focusing on a wide range of business and fiscal solutions to get your business trading successfully in the EU again; From setting up your company and administration to Fiscal Representation, EU VAT, IOSS, OSS, GPSR, fulfilment, registrations and compliance, we have the experience and the optimal trading solutions for you.

With EUify we can get you trading competitively in the EU again, boosting your profits within the world's largest single market. Our pricing is transparent and most importantly, you can pick up the phone and talk to a human when you have questions or need support!

Don't let your competitors take over, EUify your business today!