Do cross-border data rules apply to an online seller?
Short answer
Yes when a shop uses support, hosting or marketing services outside the EU. The transfer route follows the destination and the records, not the size of the shop.
Read against the registers 2026-08-26.
Who the role is
A trader who sells to a consumer at a distance, on its own site or through a marketplace.
What the topic covers
Moving records across a border is where the three regimes separate most. The EU relies on adequacy and contractual safeguards. China runs an assessment and filing route with volume thresholds. The United States has no single federal transfer rule.
The rows behind the answer
European Union
- GDPR — Regulation (EU) 2016/679: Chapter V allows a transfer on adequacy, standard contractual clauses or another named safeguard.
United States
- California Consumer Privacy Act, as amended by the CPRA: No general export restriction. Service provider contracts carry the duty instead of a transfer mechanism.
China
- Measures for the Security Assessment of Outbound Data Transfers: A security assessment by the regulator is required above the stated volume and category thresholds.
- Measures on the Standard Contract for Outbound Transfer of Personal Information: A filed standard contract is the route below the assessment thresholds, with an impact assessment attached.
- Provisions on Facilitating and Regulating Cross-border Data Flows: Names exemptions where neither the assessment nor the standard contract route is required.
Where companies usually start
- Draw the actual route of the records, including subprocessors and support access.
- Count the Chinese volume thresholds before choosing between the assessment and the contract route.
- Attach the transfer assessment to the contract, not to a separate slide deck.
This page reads published registers and describes common practice. It is not legal advice and it is not a compliance verdict.
Other questions for seller in distance selling
- Do ai governance rules apply to an online seller?
- Do personal data rules apply to an online seller?
- Do cybersecurity rules apply to an online seller?
- Do health data rules apply to an online seller?
- Do online platforms rules apply to an online seller?
- Do consumer rights rules apply to an online seller?
- Do product safety rules apply to an online seller?
- Do climate disclosure rules apply to an online seller?
- Do export controls rules apply to an online seller?
ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.
Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.
