[pmiller2]

More generally, I am wondering: how do smaller companies go about even attempting to comply with the GDPR? The “head in the sand” approach of simply not serving requests to people physically in the EU doesn’t work for a number of reasons, and I don’t see how you can even sell anything on the internet without being within its reach. (Of course, now that I think about it, how is the EU going to fine a small business in the US that has no overseas operations?)

Are there any resources for small businesses in the US that want to protect themselves from onerous fines the data regulators can impose? How can they even begin to assess the risks of noncompliance?