The territorial reach is the point most often missed. The regulation follows the person, not the company. Selling to European customers from Shenzhen puts you inside its scope.
What it requires in practice
- A lawful basis for each use of personal data — consent is one option among several, not the default.
- Transparency. A privacy notice that says plainly what you collect and why, in the language of the customer.
- Rights that work. Access, correction and deletion have to be actually available, not theoretically offered.
- Care with transfers of European data outside the EU, which includes storing it on Chinese infrastructure.
- An EU representative in many cases, when you have no establishment in the Union.
Why buyers care, beyond the law
A European company that shares customer data with you inherits responsibility for how you handle it. That makes your data practices their risk — which is why it comes up in procurement questionnaires long before it comes up from a regulator.
Treat it as a sales document, not only a legal obligation. Being able to answer the data section of a procurement questionnaire quickly and precisely is a competitive advantage.
Where to read it yourself
Official pages, opened and checked on 26 September 2026. Where a rule changes, these are the addresses that change with it — this article does not.