GDPR is not a US-only compliance checkbox. It affects how any business touching EU residents stores and uses data, which is why its influence shows up in CRM policies and sales operations globally.
GDPR (General Data Protection Regulation) is the European Union regulation governing how organizations collect, process, and store personal data of EU residents. It applies to any business worldwide that handles EU resident data, regardless of where the business is located. Core elements include lawful basis for processing, data subject rights (access, deletion, portability), breach notification within 72 hours, and fines up to 4 percent of global annual revenue.
GDPR is often summarized as "cookie banners," which badly undersells it. The six points below are what the regulation actually requires and what businesses need to know.
GDPR applies to the personal data of EU residents regardless of where the business processing that data is located. A US company with EU customers is subject to GDPR for those customers. The regulation is extraterritorial by design, which is why it has influenced data policy well beyond EU borders.
Every piece of personal data processing requires a lawful basis: consent, contract, legal obligation, vital interests, public task, or legitimate interests. The lawful basis has to be identified before processing starts and documented. "Because we have the data" is not a lawful basis under GDPR.
EU residents have specific rights: access to their data, correction, deletion (right to be forgotten), portability (take data to another provider), objection to processing, and restriction of processing. Businesses must respond to requests within 30 days (extendable by 60 days for complex cases).
A personal data breach must be reported to the relevant supervisory authority within 72 hours of becoming aware of it. Affected individuals must be notified without undue delay if the breach poses a high risk. The clock starts when the organization becomes aware, not when the breach was fixed.
GDPR penalties scale with revenue. Tier 1 breaches (lower severity) carry fines up to 2 percent of global annual revenue or 10 million euro, whichever is higher. Tier 2 breaches (serious violations) carry fines up to 4 percent of global annual revenue or 20 million euro. Real fines in the hundreds of millions have been assessed.
Organizations whose core activities involve large-scale processing of personal data or special category data must appoint a Data Protection Officer (DPO). The DPO monitors compliance, acts as the contact for supervisory authorities, and is independent in that role. Smaller organizations may not need a formal DPO but still need a defined privacy function.
GDPR grants EU residents specific rights over their data. The seven rights below are the ones most businesses respond to operationally.
A data subject can request a copy of all personal data an organization holds about them, in a readable format. The response window is 30 days. The request often triggers an archaeology project across CRM, email systems, support tools, and backups. Teams that have invested in data mapping respond faster.
If the stored data is inaccurate or incomplete, the data subject can request correction. Businesses must correct and notify any third parties the data was shared with. The right applies to all personal data, including derived data (lead scores, segmentation tags).
Also known as the right to be forgotten. A data subject can request deletion when the data is no longer needed, consent is withdrawn, or processing was unlawful. There are exceptions: freedom of expression, legal obligation, public interest, and legal claims. Deletion requires finding every copy, including backups.
The data subject can request that processing stop while a dispute is resolved. The data is retained but not actively used. CRM records in this state should be flagged so campaigns and automations do not fire against them. Deletion is a stronger action than restriction.
The data subject can request their data in a structured, commonly used, machine-readable format, and have it transmitted directly to another controller. CSV or JSON is typical. The right applies only to data provided by the subject (not derived data) and only where processing is based on consent or contract.
Data subjects can object to processing based on legitimate interests, including direct marketing. For direct marketing, the objection is absolute, no justification needed. Most consumer unsubscribe flows satisfy this right for marketing, but the CRM must honor it for all future processing, not just the specific email list.
Data subjects have the right not to be subject to decisions based solely on automated processing (including profiling) that produce legal or similarly significant effects. The right matters for credit decisions, insurance underwriting, and similar automated workflows. Human review of significant automated decisions is the common mitigation.
GDPR shows up operationally in CRM policy and configuration. The six items below are the common operational responses.
When consent is the lawful basis, it must be freely given, specific, informed, and unambiguous. Pre-checked boxes do not count. The consent record must be stored (who, when, what they consented to, how they consented). Revocation must be as easy as giving consent in the first place.
Each personal data field needs a documented lawful basis. Marketing consent for email outreach. Contract for billing data. Legitimate interests for prospecting (narrowly, with documented LIA). Public interest for regulatory data. The documentation is what regulators look at when something goes wrong.
Personal data must not be kept longer than necessary for the purpose. Retention policies define how long each category is kept. Example: lead data retained 36 months after last contact, then auto-deleted. Keeping everything forever is not GDPR-compliant and is also usually bad for data hygiene.
A data subject access request means finding every record of a person across CRM, email systems, support tools, and backups within 30 days. Dedupe hygiene matters: three records of the same person triple the search. The CRM has to be the source of truth for personal data, or the response becomes an archaeology project.
A right-to-be-forgotten request requires deletion, not just archival. The record is removed, including from backups within reasonable timeframes (typically backup retention cycle). Soft-delete that preserves the data is not sufficient. Historical reporting that must preserve metrics should use anonymization, not retention of personal data.
When a vendor (CRM, email service, enrichment tool) processes personal data on your behalf, you need a signed Data Processing Agreement (DPA). The DPA defines responsibilities, security measures, and sub-processor usage. Modern SaaS vendors publish DPAs that can be countersigned. Enterprise contracts negotiate custom DPAs.
Four misconceptions recur across businesses encountering GDPR for the first time. The clarifications below correct the common ones.
Wrong. GDPR applies based on the data subject location, not the business location. A US company with EU customers must comply with GDPR for those customers. Many non-EU businesses underestimated this when the law landed in 2018 and spent the following years retrofitting their systems.
Wrong. Consent is one of six lawful bases. Many business processing activities (billing, contract fulfillment, legitimate interests for marketing to existing customers) run on bases other than consent. The myth that consent is always required leads to consent-request fatigue that users ignore.
Wrong. GDPR applies to personal data, which includes work emails and names of EU residents in their professional capacity. B2B prospecting to EU contacts must still have a lawful basis (usually legitimate interests with a documented LIA) and must honor opt-out requests.
Wrong. Small companies have been fined, including SMBs with modest revenue. The fines scale with revenue, so a small company sees smaller numbers, but the obligation is identical. Supervisory authorities have shown they will enforce against small operators, particularly when complaints come from affected individuals.
Strkr supports GDPR, CCPA, and HIPAA compliance workflows: consent capture, data subject requests, retention policies, lawful-basis documentation. Pricing is $29 Starter, $59 Pro, $119 Scale per seat per month.
GDPR stands for General Data Protection Regulation. It is the European Union regulation governing how organizations collect, process, and store personal data of EU residents. It took effect on May 25, 2018 and replaced the earlier Data Protection Directive. The regulation applies globally to any business handling EU resident data.
GDPR applies to any organization that processes personal data of EU residents, regardless of where the organization is located. A US business with EU customers must comply with GDPR for those customers. The regulation also applies to the EU businesses themselves. Organizations that only occasionally touch EU data still need to comply.
The main rights are: access (get a copy of personal data), rectification (fix inaccuracies), erasure (right to be forgotten), restriction (stop processing without deleting), portability (export in machine-readable format), objection (stop processing, especially for direct marketing), and rights around automated decision-making. Businesses must respond to requests within 30 days.
A lawful basis is the legal justification for processing personal data. The six bases are: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Every processing activity needs a documented lawful basis. "We have the data" is not a lawful basis. The basis determines what rights apply and what notice is required.
GDPR has two tiers of fines. Tier 1 (lower-severity violations) carries fines up to 2 percent of global annual revenue or 10 million euro, whichever is higher. Tier 2 (serious violations) carries fines up to 4 percent of global annual revenue or 20 million euro. Fines in the hundreds of millions of euros have been assessed on large tech platforms.
A personal data breach must be reported to the relevant supervisory authority within 72 hours of the organization becoming aware of it. If the breach poses a high risk to individuals, affected individuals must also be notified without undue delay. The 72-hour clock starts at awareness, not at breach fix. Reporting late is itself a violation.
Strkr supports consent capture, data subject access requests (export and delete), retention policies with scheduled deletion, lawful-basis documentation per processing activity, and Data Processing Agreements with sub-processors. SOC 2 Type II is in progress for 2026-Q4. Strkr is HIPAA compliant with BAA available. Pricing is $29 Starter, $59 Pro, $119 Scale per seat per month.
No sales call, no migration consultant, no four-month implementation. Enter your card, get 14 days of the full Pro tier, cancel any time before day 14 with zero charge. Spin up a workspace, import your CSV, and have something useful before lunch.
