Do you do business in Europe? If you only have a handful of European customers, what exactly can happen if you get a letter from the French privacy regulator?

Do you do business in Europe? If you only have a handful of European customers, what exactly can happen if you get a letter from the French privacy regulator? Toss is in the bin and move on with your life. Maybe delete the complainants account if you want. The major costs with GDPR for a small player are things * understanding the law (far from trivial, particularly given how the various privacy regulators can't be arsed to produce final guidance even to date). Consent is moderately straightforward, but eg legitimate interest balancing tests aren't. * figuring out every database and table that has user data stored in it * figuring out 3rd party systems with such data (your transactional mailer, marketing mailer, billing, logging, etc) * were your marketing consents gdpr-compliant (pro-tip: they weren't). What consent is every marketing contact tied to? Why do we have to reconsent everyone when there is already a working 1-click opt-out link in every marketing email?