What is the General Data Protection Regulation (“GDPR”) and Why Does it Matter in the U.S.?

By: Kenzie Dalrymple

Data and the Digital World.

With the digital age, people are able to conduct business deals and transactions from one end of the globe to the other in seconds. However, what often goes unconsidered are the consequences. What keeps cybercriminals from exploiting that data for their own purposes? The answer, unfortunately, is often very little, especially given the anonymous nature of cybercrime. Legislators around the world have been tackling this challenge by placing the burden of data protection on businesses. One of the most prominent responses is the General Data Protection Regulation (hereinafter “GDPR”).

What is the GDPR?

The GDPR is the European Union’s (hereinafter “EU”) most comprehensive law protecting individual data privacy. It is based on the principle that digital data belongs to the individual. The GDPR applies to any organization collecting or processing personal data from EU residents, meaning a digital service may have to comply regardless of its physical location.

Some of the rights the GDPR provides are:

1. the right to access a copy of the personal data an organization holds about you;
2. the right to correct inaccurate data;
3. the right to erasure often called “the right to be forgotten”;
4. the right to restrict how your data is processed;
5. the right to data portability; and
6. the right to object to certain processing activities.

Now you may be asking yourself, “This is Europe’s law. Who cares?” but just about every business with a website or social media presence may want to pay attention.

Who does the GDPR Apply To?

You may be asking yourself, “Does the GDPR apply to me?” This is a question best answered with the guidance of a qualified attorney, as every business’ situation is different. That said, some factors that are commonly considered include:

1. if the business offers goods or services to individuals in the EU;
2. if the company monitors the behavior of EU data subjects including using digital tracking technologies; and
3. if a company processes personal data belonging to EU residents.

Even if that process occurs entirely in the United States the GDPR can still apply. If a company in the U.S. stores or processes such data about EU individuals, then it might fall within the GDPR scope.

What Happens When a Business Does Not Follow GDPR Regulations?

Non-compliance with the GDPR carries severe financial consequences. The EU has established a two-tiered fine structure that scales with the severity of the violation. Less serious infractions can result in fines of up to €10 million (approximately $11.6 million USD) or 2% of a company’s global annual revenue from the preceding financial year whichever is higher. More serious violations can reach €20 million (approximately $23 million USD) or 4% of global annual revenue, again whichever is higher.

To put those numbers in perspective: Google’s parent company, Alphabet Inc., reported global annual revenue of $402.84 billion in its most recent financial year. Theoretically, a serious GDPR violation at the 4% threshold would expose Google to a fine of roughly $16 billion USD, and that’s before accounting for any additional legal costs or penalties.

What if I’m Not a Business Owner?

The GDPR may be more relevant to everyday U.S. consumers more than they realize. If a company serves both American and European customers, it may simply apply the same data protections across its entire user base meaning you could benefit from GDPR-level privacy standards without even knowing it. For example, platforms like Spotify or Booking.com, which operate extensively in Europe, may apply their EU data privacy standards to all users globally.

In an increasingly borderless digital world, a European law has quietly become one of the most widely relevant data privacy frameworks for people everywhere.

What is ND doing about Data and Privacy Protection?

North Dakota does not yet have a comprehensive privacy law like the GDPR, but the legislature has taken meaningful steps in that direction. In 2025, the state of North Dakota signed the H.B. 1127 creating a new data breach security measure. At its core, a compliant information security program requires financial corporations to take a proactive, top-to-bottom approach to protecting customer data from conducting regular risk assessments, to encrypting data, training staff, and holding service providers to high standards. When a security incident does occur, a written response plan ensures the organization is prepared to act quickly, communicate effectively, and continuously improve.

Conclusion.

Data privacy is no longer a concern reserved for large corporations or tech companies. In an increasingly connected world, the GDPR represents a significant shift in how personal data is thought about, handled, and protected and its reach extends well beyond European borders. Whether you are a business owner trying to understand your obligations or a consumer curious about who holds your data and how it is used, the GDPR is worth understanding. As data privacy law continues to evolve globally, staying informed is one of the most practical steps anyone can take.

If you want to learn more, please contact SW&L at 701-297-2890 or email us at: info@swlattorneys.com.

The information contained in this article and on this website is for informational purposes only. Do not rely on the information on this website as legal advice. Please refer to the full disclaimer here.