I think the fines/penalty headlines are a big misunderstanding/distraction (which got me too until I had to spend the time on reading the actual law for an actu

I think the fines/penalty headlines are a big misunderstanding/distraction (which got me too until I had to spend the time on reading the actual law for an actual EU client). They are what happens if you continually, willfully disobey the principal of the laws AND are also proportional to you income (see https://en.wikipedia.org/wiki/Day-fine https://en.wikipedia.org/wiki/Day-fine which are common in some EU countries) If you are a small operator who messes up AND you are in the EU and you ignore strongly worded letters of warning with instructions on what you need to do to comply then you MIGHT be fined/penalized. If you are not making money in the EU than you are seriously unlikely to even be noticed messing up. If you miss-configured the logs on your blog or small non-EU business and kept user ids and IP addresses AND are outside the EU no one will bother you. If a privacy conscious EU citizen contacts you to close an account they made with you or delete your data you have many weeks (90 days i think ultimately) to respond, negotiate and do your best to get it done (and provide them whatever data you may have collected on them) If you have any of a dozen legitimate reasons to have personal data and you clearly explained this to the EU citizens you collected data from you are not going to hear from anyone. e.g. a EU company I work with has extensive logs of their employees changes and updates to data (imagine git commit messages). These are required logs for the business, an ex-employee cannot ask you delete that history under GDPR. Same for their b2b customers. The existence of these logs are made clear up front. It's a regulated requirement that they exist etc. If you decided to sell the log data to a third party as part of some profile of the citizen and you didnt say you intended to do that then you ABSOLUTELY would hear from someone. But I would think you very much should and this is the point. Same principles apply for California Consumer Privacy Act (CCPA) in the US.