General Data Protection Regulation

GDPR (General Data Protection Regulation) is a privacy regulation that took effect in the EU on May 25, 2018, applicable to all organizations processing personal data of EU residents, regardless of their location. In foreign trade, GDPR directly affects cross-border e-commerce, customer relationship management, email marketing, and other scenarios: sending marketing emails to EU customers requires explicit consent, collecting recipient information requires informing data usage, and exchanging business cards or customer lists with EU companies may also trigger compliance obligations. Key points include: violations can be fined up to €20 million or 4% of global annual turnover; cross-border data transfers must rely on adequacy decisions or standard contractual clauses; companies must appoint a Data Protection Officer (if core activities involve large-scale monitoring). Compared with China's Personal Information Protection Law, GDPR has stronger extraterritorial effect, stricter penalties, and requires data subjects to have the right to be forgotten, data portability, etc. Foreign trade practitioners need to specify GDPR clauses in website privacy policies, cookie consent, and supplier agreements to avoid order interruptions or legal risks due to data violations.