In other words, if your business has a customer from the EU, and as part of any business transaction, collects any personal data from that customer, your business could be subject to the rules and regulations of the GDPR.  There are absolutely no exceptions based on the size or scope of the business, which means any business with an internet presence, including those owned and operated by a sole proprietor, is potentially subject to the new law. Indeed, GDPR expressly states that its jurisdiction applies to any company processing the personal data of subjects residing in the EU, regardless of the company’s size or location. However, in order for the new law to apply to your U.S.-based business, your organization must target a data subject in an EU country.  Broad. generic marketing does not qualify. So, for example, a German user who Googles and finds an English-language webpage written for U.S. consumers would most likely not be protected under the GDPR. However, if the marketing is in the language of an EU member country and there are references to EU users and customers, then the webpage would most likely trigger the GDPR.

This broad jurisdiction of the GDPR, combined with potentially drastic penalties for non-compliance, means that the new law may have a significant impact on even businesses located far beyond the geographic shores of the EU.