# GDPR for Canadian SMBs: when it applies and what it asks > The EU privacy law can reach a Canadian business that sells to people in the EU or tracks them. When it applies, what it asks for and where to start. - URL: https://nextit.tech/blog/gdpr-for-canadian-smbs-when-it-applies-and-what-it-asks/ - Language: English - Other language: https://nextit.tech/fr/blogue/le-rgpd-pour-les-pme-canadiennes-quand-il-s-applique-et-ce-qu-il-exige/ - Publisher: NextIT (https://nextit.tech/) --- [Blog](https://nextit.tech/blog/) # GDPR for Canadian SMBs: when it applies and what it asks NextIT Privacy Team Oct 27, 2026 6 min read An online store in Montréal ships orders to France. Its owner has no office in Europe, but the European privacy law can still apply. This article explains when the General Data Protection Regulation (GDPR) reaches a Canadian business, and what it asks for. ## What the GDPR is The GDPR is Regulation (EU) 2016/679, the privacy law of the European Union (EU). It took effect on 25 May 2018. The business that decides why and how data is used is the controller. A vendor that handles data on the controller’s behalf is the processor. Exporting a product is a good comparison. When you sell it in France, you follow French rules for that product. The GDPR works the same way: when you reach people in the EU, its rules follow your data about them. ## Why it matters for an SMB Article 3(2) applies the GDPR to a business outside the EU in two cases. First, you offer goods or services to people in the EU, paid or free. Second, you monitor their behaviour in the EU. A website that people in Europe can visit is not enough on its own. The European Data Protection Board (EDPB), the group of EU data protection authorities, lists signs of targeting. Examples are delivery to EU countries, advertising aimed at an EU audience, and a language or currency not generally used in Canada, such as the euro. Monitoring includes behavioural advertising and tracking with cookies. One EDPB example is a Canadian app developer that monitors people in the EU: the GDPR applies to it. Canada has an adequacy decision from the European Commission. It covers commercial organisations subject to PIPEDA, the federal private-sector privacy law. Data can flow from the EU to them without extra safeguards. In January 2024, the Commission confirmed that Canada still offers an adequate level of protection. The decision makes transfers easier, but it does not exempt you from other GDPR rules. Under Article 83, the top tier of fines reaches €20 million or 4% of worldwide annual turnover of the previous financial year, whichever is higher. It covers the principles, the lawful bases, individual rights and transfers. A lower tier of €10 million or 2% covers duties such as records, security and breach notice. ## What it asks for ### Principles and a lawful basis Article 5 sets six principles: lawfulness, fairness and transparency; a specific purpose; only the data you need; accuracy; limited retention; and security. Article 5(2) adds accountability: you must be able to show that you follow the principles. Article 6 requires a lawful basis for each use of data. There are six: consent, a contract, a legal obligation, vital interests, a public task and legitimate interests. Choose the basis before you collect the data, and write it down. ### Rights of individuals People can ask to access their data, correct it, erase it, restrict its use or receive it in a portable format. They can also object, and an objection to direct marketing always stops that use. Article 12 gives you one month to answer, which you can extend by two months for complex or numerous requests. ### Records of processing Article 30 requires a written record of processing activities. It lists purposes, data, recipients, transfers, retention periods and security measures. A business with fewer than 250 employees is exempt only in narrow cases. The exemption does not apply when the processing is not occasional, may create a risk, or includes sensitive data or criminal records. ### Processors and contracts Article 28 lets you use only processors that give sufficient guarantees. A binding contract sets the purpose, duration, types of data and people concerned. The processor acts only on your documented instructions, keeps the data secure and needs your approval for subprocessors. It allows audits, and at the end it deletes or returns the data, as you choose. ### Breaches within 72 hours Article 33 requires notice to the supervisory authority without undue delay and, where feasible, within 72 hours after you become aware of a breach. You do not notify when the breach is unlikely to result in a risk to people. A late notice gives the reasons for the delay. Under Article 34, you also tell the people affected without undue delay when the risk to them is high. Document every breach, including the ones you do not report. ### Impact assessments Article 35 requires a data protection impact assessment (DPIA) before processing that is likely to result in a high risk to people. Examples are profiling that leads to significant decisions and sensitive data on a large scale. ### A representative in the EU Article 27 asks a business covered by Article 3(2) to name a representative in the EU, in writing. The representative is located in an EU country where the people you serve or monitor are. The duty does not apply to occasional, low-risk processing without sensitive data on a large scale. The representative does not take over your responsibility. ### How it compares with Law 25 and PIPEDA - **Breach notice:** the GDPR sets 72 hours where feasible. Law 25 and PIPEDA require prompt notice, with no fixed number of hours. - **Requests:** the GDPR gives one month. Law 25 and PIPEDA give 30 days. - **Fines:** Law 25 penal fines reach $25 million or 4% of worldwide turnover. GDPR fines reach €20 million or 4%. ## How to approach it 1. Check whether the GDPR applies. Look at where your customers are and at the signs of targeting. Write down your conclusion. 2. Map your EU data: purpose, data, people, vendors and location. This map becomes your record of processing. 3. Choose and record a lawful basis for each activity. State it in your privacy notice. 4. Sign an Article 28 contract with each processor. Many vendors offer a data processing agreement (DPA) to sign. 5. Name who assesses an incident and who notifies the authority, and test the 72-hour path. 6. Set up a request process with a one-month deadline. 7. Name an EU representative, unless the exemption clearly applies, and list it in your privacy notice. 8. Run a DPIA before new high-risk processing. ## Common mistakes - Assuming the GDPR cannot apply without an office in Europe. - Treating the adequacy decision as an exemption. It only makes transfers easier. - Relying on consent for everything. It is one lawful basis of six. - Counting on the under-250 exemption for records without checking its conditions. - Waiting for the full investigation before you notify. The 72 hours start when you become aware of the breach. **Good to know:** This article is general information, not legal advice. For your own obligations, ask a qualified lawyer. ## How NextIT helps The NextIT [Compliance report](https://nextit.tech/docs/compliance-report/) follows your Law 25 / GDPR controls with a live compliance score, and you download it as a PDF. In Privacy & Compliance, you run impact assessments, track data processing agreements and keep your ROPA register, which is your record of processing activities. The Security Incident Register and Portability Requests cover breaches and requests. The [Privacy & Compliance guide](https://nextit.tech/docs/privacy-and-compliance/) explains each part. To see how this fits your business, [book a demo](https://nextit.tech/book-a-demo/). Free posture report ### Is your business exposed? Find out in 5 minutes. Enter your domain. Confirm ownership by email, then get your free security posture & compliance report. [Book a strategic meeting](https://nextit.tech/book-a-demo/) - No card required - Hosted in Canada NextIT Privacy Team Security, Law 25 compliance and IT governance for SMBs. ### About the author The NextIT Privacy Team helps Québec and Canadian SMBs meet Law 25 and PIPEDA without a dedicated compliance department, from the first checklist to the audit. ### More articles from NextIT - [ISO/IEC 27001 explained for SMBs: the standard, the controls and the audit Oct 27, 2026](https://nextit.tech/blog/iso-27001-explained-for-smbs/) - [Law 25 explained: what Québec’s privacy law asks of SMBs Oct 27, 2026](https://nextit.tech/blog/law-25-explained-what-quebecs-privacy-law-asks-of-smbs/) - [The NIST Cybersecurity Framework 2.0, explained for small businesses Oct 27, 2026](https://nextit.tech/blog/nist-csf-2-explained-for-smbs/) - [SOC 2 explained for SMBs: what the report covers and how to prepare Oct 27, 2026](https://nextit.tech/blog/soc-2-explained-for-smbs/) - [Compliance 101 for SMBs: frameworks, controls and evidence in plain words Oct 15, 2026](https://nextit.tech/blog/compliance-101-frameworks-controls-and-evidence/) ## Scan your company. Or let's talk strategy. Get your free posture report in 5 minutes — or book a strategic meeting with our team. [Book a strategic meeting](https://nextit.tech/book-a-demo/) No credit card required · Bilingual FR / EN · Hosted in Canada