The ICO (for example) has excellent English-language guidance on the GDPR. https://ico.org.uk/for-organisations/business/ https://ico.org.uk/for-organisations/

The ICO (for example) has excellent English-language guidance on the GDPR. https://ico.org.uk/for-organisations/business/ https://ico.org.uk/for-organisations/business/ > codify it It is very difficult in my experience to make lawmakers and lawyers experts in digital marketing, telesales, medical processing, machine learning, banking and anti-money laundering and so on, so a lot of our regulation is just “do your best” and “don’t be a dick” anyway. This works remarkably well- CEOs of billion dollar companies are asking if their IT/IS systems are actually secure which is a massive improvement over what I used to see: “are we compliant” Well Equifax was probably compliant. I much prefer companies seek more than sheer profit, and to have restraint when it comes to putting peoples lives and livelihoods at risk. > (we) are just not going to gamble with what side of the bed the punishers wake up on. With all due respect, unless you go to war (which has different risks), or you ask everyone if they’re European when they reach your website (ie before you’ve given them a cookie or logged their data in your access logs; or telephone and so on) you’re going to have to. The GDPR is already law. The good news is that European law is rather fair, and if you’re not dealing with personal data as a product you probably aren’t going to be affected at all.