GDPR Compliance for Canadian SMBs Selling to Europe (2026)

GDPR — the EU's General Data Protection Regulation — does not care where your company is incorporated. It cares whose personal data you're processing and what you're doing with it. A Quebec-based Shopify store with no EU office, no EU staff, no EU bank account, and no plans to ever open one can still fall squarely inside GDPR's scope the day its first customer in Germany places an order, or the day its website analytics start tracking visitors browsing in from France. This is the single most misunderstood fact about GDPR among Canadian small and mid-sized businesses, and it's the reason this guide exists.

The second most misunderstood fact follows directly from the first: being compliant with Quebec's Law 25 or with federal PIPEDA does not mean you are compliant with GDPR. The three laws share a family resemblance — they all descend from the same broad tradition of data protection thinking, and Law 25 in particular was written with GDPR openly used as a reference point — but they differ in ways that are not cosmetic. Consent standards differ. Breach notification timelines differ. Fine structures differ by orders of magnitude. Individual rights differ in scope. A Canadian business that assumes "we did our Law 25 and PIPEDA homework, so we're covered everywhere" can walk into EU exposure without realizing it, right up until an EU customer submits a formal data request the business has no process to honour, or a EU regulator's questionnaire lands in an inbox after a breach.

This guide is written specifically for Canadian SMBs that sell goods, services, or software to people in the European Union — e-commerce stores shipping product to EU customers, SaaS companies with EU trial sign-ups and subscribers, consultants and agencies with EU clients. It covers when GDPR actually applies to a Canadian business, what it requires in practice, exactly how it differs from the Canadian privacy laws you may already be following, and a concrete, numbered path to closing the gap — including two realistic case studies and a real-world budget in Canadian dollars.

When Does GDPR Actually Apply to a Canadian Business?

GDPR's reach is defined by Article 3, and the concept it establishes is usually called "extraterritorial scope." In plain language: GDPR applies to the processing of personal data of people located in the EU, by any organization anywhere in the world, if that processing relates to either of two things.

Trigger 1 — offering goods or services to people in the EU

If your business offers goods or services to individuals located in the EU, GDPR can apply to the personal data you collect from them in the process — even if you never charge them a cent. The word "offering" is doing real work here: GDPR guidance and case law distinguish between a website that is simply reachable from the EU (which does not, on its own, trigger GDPR) and a website that is clearly targeting EU customers. Signals regulators and courts look at include:

• Pricing displayed in euros or other EU currencies
• Shipping options or delivery zones that include EU countries
• Marketing or advertising specifically aimed at EU audiences (EU-targeted ad campaigns, EU-language content)
• A website available in an EU-country language beyond just the business's default language
• References to EU customers, EU testimonials, or EU-specific terms and conditions
• A top-level domain associated with an EU member state (for example, a .fr or .de domain alongside the .ca site)

A Canadian company that simply has a public website reachable by anyone worldwide, including EU visitors who stumble onto it and place an occasional order, sits in genuinely murkier territory than a company that actively markets to the EU — but "we didn't target them, they just found us" gets weaker as a defence the more EU orders accumulate and the more the business's own site behaviour (currency options, shipping zones, language) starts to look like active targeting rather than passive availability.

Trigger 2 — monitoring the behaviour of people in the EU

The second trigger is independent of whether you sell anything at all. If your business monitors the behaviour of individuals located in the EU — and that behaviour takes place within the EU — GDPR can apply to that monitoring. In practice, "monitoring" covers a broader range of ordinary business activity than most SMB owners expect:

• Website analytics tools (Google Analytics, Meta Pixel, and similar) that track visitors from the EU, including their behaviour, location, and browsing patterns
• Retargeting and remarketing ad campaigns that follow EU visitors around the web after they leave your site
• Cookie-based tracking and profiling of EU visitors for any purpose, including analytics and personalization
• Behavioural email marketing that tracks EU subscriber engagement in detail (open rates tied to individual profiles, click-path tracking, etc.)

This second trigger is precisely why a Canadian company can be inside GDPR's scope without a single EU sale. A blog, an informational website, or a SaaS marketing site that runs standard analytics and gets meaningful EU traffic is monitoring the behaviour of people in the EU the moment that tracking captures EU visitors — the fact that nothing was ever purchased doesn't remove the monitoring trigger.

What does NOT trigger GDPR

It's worth being equally clear about the boundary on the other side, because over-applying GDPR wastes real time and money on obligations that were never triggered. A Canadian business that:

• Sells only to Canadian and US customers, with no EU shipping or service offering
• Geo-restricts its website or checkout to exclude EU visitors
• Has a website reachable globally but takes no active steps to market to or transact with EU residents, and has never had an EU customer

...is genuinely outside GDPR's scope, at least under the extraterritorial-reach provisions covered here. The compliance conversation only starts once one of the two triggers above becomes true in practice, not simply because the internet is global and your website is technically loadable from Berlin.

What GDPR Actually Requires, in Plain Language

Once GDPR applies, it brings a specific set of obligations that go beyond what most Canadian privacy law requires. None of these are exotic concepts, but several of them are stricter or more formal than their closest Canadian equivalent.

Lawful basis for processing

GDPR requires that every instance of personal data processing rest on one of six lawful bases: consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a public task, or legitimate interests. In practice, most Canadian SMB processing falls under "contract" (you need the customer's shipping address to fulfill an order), "consent" (you need explicit opt-in to send marketing emails or run non-essential tracking cookies), or "legitimate interests" (a balancing test that lets you process data for reasonable business purposes provided it doesn't override the individual's rights and interests). The requirement that matters operationally: you must be able to state, for each category of data you collect, which lawful basis justifies it — not just collect data because it seemed useful.

Consent standards — stricter than PIPEDA's

Where GDPR consent is the relevant lawful basis, it must be freely given, specific, informed, and unambiguous, given through a clear affirmative action. Pre-ticked checkboxes, consent bundled into broad terms-of-service acceptance, and "by continuing to browse you accept our cookies" banners with no real opt-out do not meet this standard. This is materially stricter than PIPEDA's approach, which allows more room for implied consent depending on the sensitivity of the data and the reasonable expectations of the individual. A cookie banner that satisfies PIPEDA's implied-consent comfort zone will often not satisfy GDPR's opt-in requirement for EU visitors.

Data subject rights

GDPR gives individuals a specific, enumerated set of rights over their personal data, and a business subject to GDPR must have a real process to honour them, typically within one month of a valid request:

• Right of access — an individual can request a copy of the personal data you hold about them
• Right to rectification — correcting inaccurate personal data
• Right to erasure ("right to be forgotten") — having personal data deleted under certain conditions
• Right to data portability — receiving personal data in a structured, commonly used, machine-readable format, and having it transferred to another provider where technically feasible
• Right to restrict processing — limiting how data is used while a dispute is resolved
• Right to object — objecting to processing based on legitimate interests or for direct marketing purposes

PIPEDA gives Canadians a right of access and correction, but does not include a formal, GDPR-style right to erasure or the specific data portability right in the same form. A Canadian SMB with no documented process for "an EU customer emails asking us to delete everything we have on them" is not GDPR-ready even if it handles Canadian access requests fine today.

The 72-hour breach notification rule

This is one of the sharpest practical differences from Canadian law. Under GDPR, if a personal data breach is likely to result in a risk to the rights and freedoms of individuals, the organization must notify the relevant EU supervisory authority within 72 hours of becoming aware of the breach — a fixed clock, not a judgment call. PIPEDA's standard, by contrast, requires notification when there is a "real risk of significant harm," without a hard 72-hour deadline. A Canadian business used to PIPEDA's more flexible, harm-based timeline can be caught flat-footed by GDPR's fixed clock if it doesn't already have an incident response process built around identifying, assessing, and reporting within that window.

Records of processing activities (ROPA)

GDPR expects organizations — with a narrow exemption for some businesses under 250 employees doing only occasional, low-risk processing — to maintain a written record of their processing activities: what personal data is collected, why, how long it's retained, who it's shared with, and what security measures protect it. Most small Canadian exporters fall near this exemption boundary, but the exemption doesn't apply if the processing is regular rather than occasional, or if it's likely to risk the rights of the individuals involved, or if it involves special categories of data — which means many SMBs assume they're exempt without actually checking whether their specific activity qualifies.

Data Protection Officer (DPO) thresholds

A formal DPO is mandatory only when core activities require regular and systematic monitoring of data subjects on a large scale, or large-scale processing of special categories of data (health records, biometric data, and similar), or when the organization is a public authority. Most Canadian SMBs selling to Europe fall below this bar. That said, GDPR still expects someone in the organization to own privacy compliance accountability even without the formal title — in a small business, this is often the owner or an operations lead wearing the hat informally.

EU representative requirement

A non-EU controller or processor that falls under GDPR's extraterritorial scope may be required to designate a representative established in the EU, who acts as the point of contact for EU supervisory authorities and data subjects. There's an exemption for processing that is occasional, doesn't include large-scale special-category data, and isn't likely to result in a risk to individuals' rights. A Canadian e-commerce shop with a handful of EU orders a year likely qualifies for the exemption; a SaaS company with a steady, growing EU subscriber base is more likely to need to designate a representative once volume and regularity increase.

International data transfer mechanisms

GDPR restricts transferring EU personal data to countries outside the European Economic Area unless the destination offers an adequate level of protection. Canada holds a partial adequacy decision from the European Commission, but the coverage is narrower than most people assume: it applies to organizations subject to PIPEDA and processing personal data in the course of commercial activities. Data handled outside that scope, or by organizations or activities not covered by PIPEDA, isn't automatically covered by the adequacy decision. Where the adequacy decision clearly applies, EU-to-Canada transfers can proceed without additional transfer mechanisms; where it doesn't clearly apply, Canadian businesses typically rely on Standard Contractual Clauses (SCCs) — European Commission-approved contract clauses signed between the EU party and the Canadian recipient — to create a lawful basis for the transfer.

GDPR vs Quebec's Law 25 vs Federal PIPEDA — the Real Differences

This is the comparison most Canadian SMBs never see laid out concretely, and it's the reason "we're already Law 25/PIPEDA compliant" is not the same statement as "we're GDPR compliant." Our companion guide on Law 25 vs PIPEDA for multi-province business covers how those two Canadian laws relate to each other; the table below adds GDPR as the third point of comparison, since that's the gap that catches businesses expanding into Europe.

The pattern across every row is the same: GDPR is generally the strictest of the three, with the highest stakes (fines), the tightest deadlines (72 hours), and the broadest individual rights (erasure, portability). Law 25 sits closer to GDPR in structure and intent than PIPEDA does, which is exactly why some Quebec businesses assume Law 25 compliance carries over — but "closer to" is not "equivalent to," and the gaps in consent mechanics, breach timing, and fine exposure are real. Our guide on PIPEDA compliance for accounting and law firms goes deeper into the federal baseline if that's the starting point for your business.

GDPR Readiness Steps for a Canadian SMB

Here is the practical, ordered sequence for a Canadian SMB that has determined GDPR applies, or suspects it might. This mirrors the numbered plan most businesses actually need to work through, roughly in this order.

Steps one through four are the ones every GDPR-affected Canadian SMB needs regardless of size. Steps five through seven scale in urgency with the volume and sensitivity of the EU data you handle — a small shop with occasional EU orders can move through them at a measured pace, while a SaaS company with a growing EU subscriber base should treat all seven as immediate priorities. For a broader technical baseline that GDPR readiness builds on top of, our IT security audit checklist for business covers the underlying access-control and data-security fundamentals that make several of these steps meaningfully easier to execute.

GDPR Readiness Checklist for Canadian SMBs

A working checklist to track progress against, roughly in the order most businesses tackle it:

• ☐ Confirm whether you target and/or monitor EU residents (review actual orders, shipping zones, and analytics traffic, not just intent)
• ☐ Inventory every system and vendor that touches EU customer or visitor personal data
• ☐ Document a lawful basis for each category of EU personal data you process
• ☐ Update your privacy policy with GDPR-required disclosures (data collected, purpose, retention, rights, contact)
• ☐ Implement a genuine opt-in consent mechanism for non-essential cookies and tracking on EU visitors
• ☐ Review and, if needed, replace analytics/marketing tools that don't offer EU-compliant consent controls
• ☐ Build a documented process for handling data subject access, correction, and erasure requests within one month
• ☐ Confirm your data transfer basis for moving EU data to Canadian or third-country servers (adequacy or SCCs)
• ☐ Sign or update data processing agreements (DPAs) with vendors that touch EU personal data (payment processors, email platforms, cloud hosting, analytics)
• ☐ Determine whether you meet the threshold requiring an EU representative
• ☐ Determine whether you meet the threshold requiring a formal Data Protection Officer
• ☐ Assess whether you're exempt from formal records of processing activities, or need to start maintaining them
• ☐ Build and rehearse a breach response process that can meet the 72-hour notification clock
• ☐ Train staff who handle EU customer data on the basics of what's different from your existing Law 25/PIPEDA practices
• ☐ Set a recurring review date (annually at minimum) to reassess as EU volume changes

Case Study: A Quebec E-Commerce Retailer's Retrofit

A Montreal-area home goods retailer running a mid-sized Shopify store had built its business almost entirely around Canadian and US customers for its first several years. Growth from organic search and a run of Pinterest-driven traffic started pulling in a steady trickle of orders from France, Germany, and the Netherlands — nothing dramatic, roughly 4-6% of monthly order volume by the time the owner noticed the pattern in the store's country-of-origin reporting.

What actually triggered the compliance review wasn't the EU orders themselves — it was a data access request. A customer in Belgium emailed asking, in reasonably formal language, what personal data the store held about them and requesting it be deleted under "my GDPR rights." The store had no process for this at all: no documented way to search for and export one customer's full data footprint across Shopify, the email marketing platform, and the customer support helpdesk, and no clear internal owner for the request. The order got handled manually and slowly, and it prompted the owner to ask a more uncomfortable question: how many more of these might already be sitting unanswered, and what would happen if the next one came from a regulator rather than a customer.

The retrofit that followed took about six weeks and touched several parts of the business:

• Cookie consent banner replaced — the existing "by using this site you accept cookies" notice was swapped for a genuine opt-in consent tool that geo-detects EU visitors and blocks non-essential tracking scripts (including the marketing pixel) until consent is given
• Privacy policy rewritten — updated to include GDPR-required disclosures, a plain-language explanation of data subject rights, and a dedicated contact path for EU privacy requests
• Data processing agreements signed — with the email marketing platform, the customer review app, and the shipping/fulfillment software vendor, formalizing how EU customer data flows between the store and each vendor
• A documented request process built — a simple internal checklist and template response for access, correction, and erasure requests, cutting future response time from weeks to days
• Standard Contractual Clauses reviewed — with legal input, confirming which vendor relationships needed SCCs versus which were already covered under Canada's partial PIPEDA-linked adequacy status

Total cost came to roughly $4,200 CAD — a mix of a few hours of legal review for the privacy policy and SCC questions, a paid consent-management app subscription, and IT time to implement the tracking changes and build the request-handling workflow. The owner's honest reflection afterward was that the technical changes were straightforward once scoped properly; the actual difficulty was simply not knowing what was required until an EU customer's email forced the question. The store now reviews its EU order volume quarterly and treats it as an ongoing, not one-time, compliance item.

Case Study: A Canadian SaaS Company's EU Trial Funnel

A smaller example, on a tighter budget: a two-person Ontario-based SaaS company selling a scheduling tool to small service businesses started seeing a modest but real stream of free-trial sign-ups from the UK and Ireland after a product review site included them in a comparison roundup. Roughly 15-20 EU trial sign-ups a month, converting a handful into paying subscribers. Because the company was pre-revenue-scale and cost-conscious, the founders took a deliberately scoped-down approach rather than a full enterprise compliance program: they updated the sign-up form's consent checkboxes to be genuinely opt-in and unbundled from the general terms of service, added a short GDPR-specific section to their existing privacy policy addressing lawful basis and data subject rights, and set up a manual (not automated) process to handle any deletion or access requests using their existing customer database export tools, since volume was low enough that automation wasn't yet justified. They determined, after a short paid consultation, that their volume and risk profile fell within the "occasional processing" exemption for both the EU representative and formal records-of-processing requirements — a determination worth revisiting if EU volume grows meaningfully.

Total cost: under $1,500 CAD, split between a single paid consultation to confirm their exemption eligibility and a few hours of the founders' own time updating the sign-up form and privacy policy. The lesson from this smaller case study matters as much as the retailer's: GDPR readiness is not a fixed, one-size-fits-all price tag. A small, low-volume EU footprint genuinely justifies a lighter compliance program than a business doing sustained EU commerce — the risk is treating "GDPR applies" and "I need the full enterprise compliance stack" as the same statement, when they aren't.

Budget: What GDPR Compliance Actually Costs a Canadian SMB (CAD)

Costs scale with EU volume, data sensitivity, and how much you can reasonably do in-house versus needing outside help. Realistic Canadian-dollar ranges for a typical SMB:

The pattern worth internalizing: the cost is driven far more by how much legal and technical uncertainty you're starting from than by company size alone. A business that scopes the work clearly — knowing exactly what data it collects and where it flows — spends meaningfully less than one that has to discover its own data footprint from scratch as part of the project.

Canadian Government & Reference Resources

Several Canadian public resources are relevant to a business navigating GDPR alongside its domestic obligations, though none of them are a substitute for EU-specific legal advice:

• Office of the Privacy Commissioner of Canada (opc.gc.ca) — the federal privacy regulator publishes guidance on PIPEDA and on cross-border data transfer considerations, including how Canadian organizations should think about accountability when personal information moves internationally. It's the right first stop for understanding how your existing PIPEDA obligations interact with data leaving or entering Canada.
• Innovation, Science and Economic Development Canada / ISED (ised-isde.canada.ca) — publishes resources aimed at Canadian SMBs on digital trade and exporting, including material relevant to businesses expanding sales into international markets like the EU, where privacy and data-handling expectations are part of doing business.
• Business Development Bank of Canada / BDC (bdc.ca) — offers advisory support for Canadian businesses expanding internationally, and can be a useful resource for connecting the compliance side of EU expansion (privacy, data handling) with the broader operational and financial planning of selling into a new market.
• European Commission (ec.europa.eu) — the official EU source for GDPR text, guidance, and adequacy decision status, including Canada's. For anything where the exact legal wording or current adequacy status matters, this is the authoritative reference rather than any secondary summary, including this one.

If you're building out a broader compliance and security posture rather than tackling GDPR in isolation, our managed IT services can maintain consent tooling, access controls, and breach-response readiness on an ongoing basis, and a security audit is a practical starting point for mapping the technical side of your current data footprint before committing to a full retrofit.

Frequently Asked Questions