ed data processing. However, there is also a paragraph (par. 1b art. 6.) which states that this does not apply if the decision “is necessary for entering into, or performance of, a contract between the data subject and a data controller.”
So, you may state in your terms and conditions that your website is not for visitor use from the EU. Your terms and conditions serve as a contract between you and a visitor to your website; this means that blocking access to EU visitors is just an enforcement of that contract.
GDPR also protects European Economic Area countries, according to the “Third Countries” Issue. Some of these territories are not in Europe so you will have to block those countries as well. These are the Azores, Canary Islands, Guadeloupe, French Guiana, Madeira, Martinique, Mayotte, Reunion, and Saint Martin.
One more important thing when blocking IPs from the EU is to collect no other data besides the IP of the country from which the user is trying to access your website. Even if all that you know about the user is the country, they’ll still remain unidentifiable. To do this you should set your website to block users before your Google analytics, and any other data processing tools you might be using, start to collect data.
The EU-US Privacy Shield (Issue: Third Countries) is a framework created to allow the transfer of personal data from the EU to the US. The EU doesn’t allow the transfer of data to other countries unless they have adequate data protection laws. The US doesn’t meet this requirement so the Privacy Shield was created to correct this problem. It is the framework that certifies US companies as secure enough to transfer data outside of the EU.
Joining the Privacy Shield program is a good way to jump start your company on the road to becoming GDPR compliant. However, joining does not make you GDPR bulletproof. Even as part of the program, you should still double check if your business is completely GDPR compliant or you could pay enormous fines, as mentioned above.
GDPR is a law that will most likely affect you if you are running a website, no matter where you are in the world. It is a strict law which could result in possibly serious fines for anyone who breaches it.
At first glance, it seems hard work to become GDPR compliant, but ultimately, it is a fair law. You should inform users of your website about the ways you will be handling their data and ask for their permission in order to do so.
Instead of looking at GDPR as a complication, view it as an opportunity to build trust with your customers.
Author Bio: Karen Evans is a former college student who, after making real money learning how to build niche blogs, decided to go full time and hasn’t looked back since.
After seeing so many people waste time and money trying to learn how to create websites that make money she decided to create the ever-popular StartBloggingOnline.com.