In reply to Carl Hancock.

@davidanderson

Two things in one comment as this comments thread is getting complex.

First, GDPR is not a new "arbitrary fiat" that "abolishes the existence of other soverign nations states". The European data protection framework has been in place since 1995. If you're in the US you know it as the Privacy Shield framework, previously Safe Harbor. GDPR is an upgrade and modernisation of the 1995 structure.

As I said in a previous comment, enforcement is through member states, not "the EU" ravenous anti-sovereign monolith the red tops would have you believe. The third step in the enforcement process in the case of a data breach or a refusal to come into compliance, before a fine, can be a member state's DPA ordering a non-EU company to stop processing data - essentially, to cease operations - in that member state. That would be, to use the earlier example, Austria ordering the Brazilian SAAS to cease doing business in Austria. That is absolutely within their legal right to do so.

The only companies which are going to be dealt with by the EU as a whole can be counted on one hand. Facebook, Google, etc.

For everyone else, the non-EU companies that have the most to worry about in their GDPR compliance processes are the ones that were not in compliance with the 1995 legal framework to begin with. Methinks some of them doth protest too much.

Second, on the obligations of non-EU companies engaging in consistent or high-volume data processing in the EU despite not having a physical or legal presence within it: suggest you read up on GDPR Chapter 1, Article 3; Chapter IV, Article 27, and all of Chapters V and VII, particularly pertaining to DPOs and lead supervisory authorities.