Here's the question: are you willing to bet 20 million euros on your best practices? That's the maximum penalty as I understand it: https://gdpr.report/news/20

Here's the question: are you willing to bet 20 million euros on your best practices? That's the maximum penalty as I understand it: https://gdpr.report/news/2017/06/16/gdpr-guidelines-consequences-non-compliance/ https://gdpr.report/news/2017/06/16/gdpr-guidelines-conseque... - and that doesn't count the cost of litigation before being fined. This has already been posted in here, but I count GDPR compliance as being able to respond to this: https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce... Even if I think I'm completely compliant, I think I'd make the decision to limit it to North America until I had enough revenue to hire a separate data protection officer.