Growing beyond Canada

The GDPR reaches you directly under Article 3(2) the moment you offer goods or services to people in the EU, or monitor their behaviour. It does not matter that you have no office there, no entity there, and no staff there.

• An EU representative. Article 27 requires most organisations caught by Article 3(2) to designate a representative established in a Member State where the people whose data you handle are located.
• A lawful basis, and the transparency to match. Consent is one of six, and rarely the right one for a business relationship.
• Data subject rights on a one-month clock, which is tighter than anything in Canadian law.
• Breach notification within 72 hours to the supervisory authority. PIPEDA says “as soon as feasible”; the GDPR gives you a number, and it is a small one.
• Records of processing under Article 30, which is close enough to an ISO 27001 asset inventory that the work carries over.
• The AI Act, already live in the part that catches most people. Article 50 transparency has applied since 2 August 2026: tell people they are talking to a machine, mark synthetic content machine-readably, label deepfakes. Systems deployed before that date have until 2 December 2026. The expensive high-risk obligations were deferred to December 2027, so the cheap part is the part that is due now.

Since Brexit the UK runs its own regime, and in 2026 it stopped merely being a copy. The Data (Use and Access) Act 2025 came fully into force — most of it on 5 February, the rest on 19 June — and moved UK law away from the EU GDPR in twelve places. The obligations now stack rather than overlap, and in one important respect the UK is looser than Europe rather than stricter.

• A separate UK representative under the UK’s own Article 27, if you are caught and have no UK establishment. An EU representative does not cover you here, and vice versa.
• Its own regulator, the Information Commissioner’s Office, with its own reporting route.
• Its own adequacy findings. The UK recognises Canada on broadly the same partial basis the EU does. — and the European Commission renewed both UK adequacy decisions on 19 December 2025, running to 27 December 2031, with a review at the four-year mark. Data moves EU–UK freely for now.
• PECR for electronic marketing, which is stricter than CASL in some respects and looser in others. — and whose maximum fine rose from £500,000 to £17.5 million or 4% of global turnover. A thirty-five-fold increase, and the reason your UK consent evidence now deserves real attention.

The United States is the hardest of the three, not because any single rule is severe, but because there is no single rule. There is no federal comprehensive privacy statute. Instead there are twenty state laws in effect during 2026, with more enacted and waiting, plus sectoral regimes that cut across all of them.

• Most states catch you on a threshold. Texas and Nebraska catch you on presence. Most set a count — tens of thousands of residents’ data, or a lower count where you make money from selling it. Montana now bites hardest, at 25,000 residents or 15,000 if you sell data, after its thresholds were lowered in October 2025. But Texas and Nebraska set no number at all: doing business there and processing personal data is enough, unless you are a small business under the US federal definition. For a mid-sized Canadian firm those two are usually the first laws to apply and the last to be noticed. You can be caught in a state you have never visited.
• Sectoral law sits on top. HIPAA for health, GLBA for financial, COPPA for children. These apply regardless of the state regime.
• Consumer rights vary by state — access, deletion, correction, opt-out of sale and of targeted advertising, and in several states a right to opt out of profiling.
• Attorneys General enforce, and several now do so actively rather than theoretically.