# GDPR

> Learn about GDPR compliance for creators selling digital products to customers in the European Union.

Canonical URL: https://crevio.co/glossary/gdpr

##  What is GDPR?

GDPR (General Data Protection Regulation) is a comprehensive data privacy law enacted by the European Union in 2018. It gives EU residents control over their personal data and requires businesses—including creators selling [digital products](/glossary/digital-product)—to handle that data responsibly. GDPR applies to any business serving EU customers, regardless of where the business is located.

## Why GDPR Matters for Creators

If you sell courses, memberships, or digital products to anyone in the EU, GDPR applies to you. Non-compliance can result in significant fines, but more importantly, respecting customer privacy builds trust and demonstrates professionalism.

## Key GDPR Principles

### Lawful Basis for Processing
You need a valid reason to collect and use personal data:
- **Consent**: User explicitly agrees (email signups)
- **Contract**: Necessary to deliver a purchased product
- **Legitimate Interest**: Reasonable business purposes

### Data Minimization
Only collect data you actually need. Don't ask for information you won't use.

### Purpose Limitation
Use data only for the purposes you stated when collecting it.

### Transparency
Be clear about what data you collect and how you use it.

### Data Subject Rights
Customers can request access to, correction of, or deletion of their data.

## GDPR Requirements for Creators

### Privacy Policy
- Explain what data you collect
- State how you use and protect data
- List any third parties you share data with
- Provide contact information for privacy questions

### Consent Collection
- Get explicit opt-in for [email marketing](/glossary/email-marketing)
- Don't use pre-checked consent boxes
- Keep records of when and how consent was given
- Make it easy to withdraw consent

### Cookie Notice
- Inform visitors about cookies used
- Get consent before setting non-essential cookies
- Provide options to accept or reject cookie categories

### Data Security
- Use secure connections (HTTPS)
- Protect customer data appropriately
- Have a plan for data breaches

### Data Subject Requests
Be prepared to:
- Provide customers with their data on request
- Delete customer data when requested
- Correct inaccurate information

## Practical Steps for Compliance

### Website & Checkout
- Add cookie consent banner
- Display privacy policy link at checkout
- Use double opt-in for [email lists](/glossary/email-list)
- Secure all data transmission

### Email Marketing
- Confirm subscriptions with double opt-in
- Include unsubscribe links in every email
- Honor unsubscribe requests promptly
- Don't buy or use scraped email lists

### Customer Data
- Document what data you collect
- Know where data is stored
- Understand your data processors (platforms you use)
- Have a process for data requests

### Tools & Platforms
- Use GDPR-compliant platforms
- Review Data Processing Agreements (DPAs)
- Ensure third parties meet GDPR standards

## GDPR-Related Terms

- **Data Controller**: You (the business collecting data)
- **Data Processor**: Platforms handling data on your behalf
- **Data Subject**: Your customers whose data you collect
- **DPA (Data Processing Agreement)**: Contract with processors about data handling

## Common Misconceptions

- "I'm not in the EU, so GDPR doesn't apply" — It applies if you have EU customers
- "I only need consent for everything" — Contract fulfillment is also valid
- "Small businesses are exempt" — There's no size exemption
- "I'll just block EU visitors" — Possible but may limit your market

## Related Regulations

- **CCPA**: California Consumer Privacy Act (similar rights for California residents)
- **ePrivacy**: EU regulation specifically for electronic communications
- **CAN-SPAM**: US email marketing requirements

## Resources

Consider consulting with a legal professional for full compliance. Many platforms (like [Kajabi](/glossary/kajabi), [Thinkific](/glossary/thinkific), etc.) provide GDPR-compliant tools and templates to help creators meet requirements.