General Data Protection Regulation (GDPR)
General Data Protection Regulation (GDPR) is Regulation (EU) 2016/679, adopted April 27, 2016 and applied from May 25, 2018, that governs processing of personal data of people in the EU, including by non-EU businesses.
What it requires
Controllers must have a lawful basis, minimize and secure data, answer access and erasure requests within one month, and report personal data breaches to authorities within 72 hours. Processors, such as 3PLs handling customer addresses, need a written Article 28 contract and may act only on instructions. Transfers outside the EU need an adequacy decision, such as the EU-US Data Privacy Framework, or safeguards like standard contractual clauses. Fines reach EUR 20 million or 4 percent of worldwide turnover.
Why it matters
GDPR applies to every shipping label, return form and tracking email sent to an EU customer, which makes fulfillment providers data processors for their clients. A US 3PL receiving EU order data needs a data processing agreement, limited staff access and deletion of data when the contract ends. For example, keeping consignee phone numbers in a WMS for years after delivery without a reason can breach storage limitation rules. Clear retention settings and secure carrier integrations reduce risk.
Related laws
Sources
- Regulation (EU) 2016/679 (EUR-Lex) eur-lex.europa.eu
- European Commission: Data protection commission.europa.eu
Not legal advice.