Privacy Lawyers

Yes. If you sell to people in the European Union, the GDPR applies to you. It doesn’t matter where your business is based. Under Article 3, the law extends beyond Europe to cover any company that offers products or services to EU residents or tracks their behavior online. So if you accept orders from the EU, you're legally required to follow GDPR rules. The GDPR lays out key principles in Article 5. In simple terms: • You must have a lawful basis before collecting personal data (lawfulness). • Data must be collected and used fairly and transparently (fairness and transparency). • Only gather the minimum data necessary and for clear, legitimate purposes (purpose limitation and data minimisation). • Keep personal data accurate and update or correct it when needed (accuracy). • Don’t keep data longer than required for the stated purpose (storage limitation). • Protect data with appropriate technical and organizational safeguards (integrity and confidentiality). • Be able to show regulators that you comply with all of these rules (accountability). You also need to be able to prove you're doing all this if a regulator asks. When Are You Allowed to Use Customer Data? For things like shipping an order or taking payment, you’re covered by what's called the “contract” basis under Article 6(1)(b). You need info like names, addresses, and payment details to complete a sale. That’s allowed. For email marketing, things are stricter. Consent is usually required. That means a clear opt-in, like an unchecked box the customer has to actively click. Some EU countries allow limited “soft opt-in” for existing customers, but the rules vary by country. If you’re unsure, it’s safest to get clear consent before emailing EU customers with promotions. What Rights Do Customers Have Over Their Data? Articles 15–21 give EU customers a lot of control. They can: • Ask what data you have on them • Correct wrong info • Ask you to delete their data (in certain cases) • Tell you to stop using it • Opt out of marketing • Ask you to send their data to another company You need systems in place to respond to these requests quickly and efficiently. What About Cookies? The EU’s top court (in the Planet49 case) made it clear: you can’t assume consent for tracking cookies. That means: • No pre-checked boxes • No vague “we use cookies” banners • You must let users actively choose which types of cookies to allow • You need to record and prove that consent was given Your cookie banner should be easy to use and offer equal choices for accepting or rejecting cookies. How to Keep Customer Data Secure You’re expected to take technical and organizational steps to protect people’s personal data. That includes things like: • Using SSL/TLS encryption • Restricting access to databases • Having solid contracts with vendors who handle customer data If there’s a data breach, Article 33 says you must tell the relevant EU authority within 72 hours if the breach could put someone’s rights at risk. If it’s a serious risk to individuals, Article 34 says you also need to inform the affected customers. What If You Use Outside Vendors? If you work with third parties such as payment processors, email services, or cloud providers, you’re responsible for what they do with customer data. The GDPR requires you to sign Data Processing Agreements (DPAs) with them. These agreements must cover: • How they protect the data • Their legal obligations • How they’ll help you stay compliant You can’t skip this part. It’s not optional. Do You Need an EU Representative? If you regularly sell to EU customers, the answer is yes. Article 27 requires most non-EU businesses to appoint an official representative inside the EU. This rep acts as your point of contact for EU regulators and customers. You only get an exemption if: • You rarely process EU data • It’s low-risk • It doesn’t involve sensitive data But if you're actively targeting or shipping to EU customers, that exemption likely won’t apply. What Happens If You Don’t Comply? Regulators can fine you up to €20 million or 4% of your global annual revenue, whichever is higher. That said, small businesses aren’t usually hit with huge fines right away. Most EU regulators aim to help companies comply, especially if you’re clearly making an effort. But ignoring GDPR isn’t a good strategy. Being able to show you’ve taken real steps toward compliance is your best protection. Attorneys on Contracts Counsel are ready to help with GDPR compliance, including privacy policies, vendor contracts, and other legal obligations tailored to your business needs.

You are smart to consider GDPR, but also should consider US Privacy Policies in connection with the agreement. There are several states the already have GDPR level of privacy policies and over 20 states with bills introduced as well. A well formed policy will consider the data collected, where it is stored and how it is transferred, who has access to the data, the purpose of the data for use in the app, the ability to sell or reuse the data for additional purposes, and when the data should be deleted. This process should be contemplated and consistent within employee manuals, data access procedures, and implemented in master services agreements across all vendors, subcontractors, and suppliers. One final note is that you need to practice what you write, because a published privacy policy that is not followed may be considered a deceptive trade practice by the FTC resulting in fines on top of the costs of a breach.

There are myriad laws that govern privacy. In the U.S. there are the U.S. Privacy Act, HIPPA for health info, GLBA for financial, COPPA protecting children, and now more States are adding privacy laws. In 2023 alone, new consumer privacy laws will be effective in California, Colorado, Connecticut, Utah, and Virginia. Doing business internationally? The GDPR in the EU is recognized as something of a gold standard for individual privacy. The GDPR created ongoing obligations for maintains and updating privacy implementation. Companies located anywhere, not just the EU, must appoint a Data Protection Officer (“DPO”) if they have to carry out large scale, regular and systematic monitoring of people, for example online behavior tracking or large scale processing of sensitive (special category) data or data relating to crimes and criminal convictions.

As an online business collecting customer data in Texas, you're right to be concerned about data protection compliance. Data privacy regulations depend on where your customers are and your volume of business. A Data Processing Agreement is a contract between a data controller (you, as the business owner) and a data processor (any third party that processes personal data on your behalf). It establishes the rights and obligations of each party regarding the processing of personal data. It helps ensure compliance with applicable data protection laws. It also discloses to your customers which companies are processing their data. Whether you need a DPA depends on several factors: Third-party services: If you use services like payment processors, cloud storage providers, email marketing platforms, or website hosting that access your customers' personal data, you likely need DPAs with these service providers. Applicable laws: While Texas doesn't have a comprehensive data privacy law like California's CCPA, it does have the new Texas Data Security and Privacy Act, which likely impacts you if your company earns 25%+ of its revenue from selling consumer data or hits other revenue thresholds. Laws in other states and in the EU also might apply. Industry standards: DPAs have become standard practice for demonstrating data protection compliance, regardless of strict legal requirements. Benefits of Implementing a DPA: Even if not strictly required by law in Texas, DPAs offer significant benefits: (1) clarify responsibilities between your business and service providers; (2) reduce legal liability through contractual protections; (3) increase customer trust by demonstrating a commitment to data protection; (4) preparation for evolving data protection laws; and (5) a potential competitive advantage over businesses without such protections. As data privacy regulations evolve, implementing DPAs now positions your business ahead of compliance requirements while building customer trust through demonstrated commitment to data protection. I use one in my practice. You should speak with an attorney who can provide a detailed DPA analysis based on your industry and customers.

Online platforms can modify their terms of service and privacy policies without advance notice if: (1) Their terms explicitly allow such changes, and (2) Users continue using the platform after changes are made. However, modifications may still be challenged if they are unconscionable or violate privacy laws, particularly if they significantly impact user rights or data protection. While platforms may have the right to make unannounced changes, the enforceability depends on the specific modifications and their compliance with applicable regulations.