TL;DR: Cross-Border VAT and GDPR: Managing Sales Across 27 Countries. Practical tips for handling complex European tax and privacy requirements.3
Cross-Border VAT and GDPR: Managing Sales Across 27 Countries. Practical tips for handling complex European tax and privacy requirements.3 means you need one clean sales system that handles EU tax rules and personal data rules at the same time, so you can sell across Europe without building hidden legal and financial risk.
• If you sell SaaS, digital products, subscriptions, courses, or goods in the EU, your checkout, invoices, cookies, CRM, refunds, and vendors all affect both VAT and GDPR.
• The article’s biggest benefit for you is a simple founder-friendly model: map your sales and data flows, set tax rules, set privacy rules, fix checkout, test country by country, and review your stack every quarter.
• It also shows where founders get hurt most: wrong VAT treatment, weak invoice records, copied privacy policies, invalid consent, and vendors that store or process customer data without clear contracts.
• You do not need 27 separate systems on day one. You need one operating model with local flags, backed by a live data map, a vendor register, short incident playbooks, and proof you can show during audits, buyer reviews, or tax checks.
If you want a quick reference point, review official EU VAT rules and plain-language GDPR guidance, then audit your checkout and vendor stack this week.
Check out startup news that you might like:
Breaking Through Creative Ops Bottlenecks: Your 2026 Technology Roadmap by Canto
Cross-Border VAT and GDPR: Managing Sales Across 27 Countries. Practical tips for handling complex European tax and privacy requirements.3 is the reality check many founders need before they start selling across the EU and discover that one product page can trigger tax, privacy, consumer, payments, invoicing, and record-keeping duties in multiple jurisdictions at once. For startups specifically, this topic is about building a sales machine that can cross borders without creating silent legal debt.
If you sell software, digital services, subscriptions, courses, physical goods, or mixed offers into Europe, you are not “just testing a market.” You are entering a rules-heavy commercial zone with 27 member states, harmonized EU law, local enforcement habits, and a very low tolerance for sloppy data handling. I write this as Violetta Bonenkamp, a bootstrapping founder who has spent years building across Europe, and my view is simple: compliance should live inside the workflow, not inside a folder nobody opens until a complaint arrives.
What is cross-border VAT and GDPR management? It is the coordinated handling of indirect tax and personal data duties when you sell to customers in more than one EU country. VAT, or Value Added Tax, governs how you charge, report, and remit tax on sales. GDPR, or the General Data Protection Regulation, governs how you collect, use, store, share, and protect personal data. For startups, the hard part is that these systems interact. Your checkout, CRM, invoices, analytics, consent banners, refund flows, and vendor stack all touch both.
Why this matters for startups: done well, it helps you enter Europe faster, close enterprise deals sooner, avoid ugly tax surprises, and reduce the risk of privacy complaints. Done badly, it creates blocked expansion, delayed due diligence, messy audits, and expensive retroactive fixes.
Key takeaway
- How cross-border VAT and GDPR affect startup growth and EU sales
- How to set up tax and privacy workflows that work across 27 countries
- The founder mistakes that create avoidable legal and financial exposure
- A practical operating model for lean teams with limited time and budget
Why does cross-border VAT and GDPR matter so much for startups now?
The challenge is brutal for small teams. Europe looks like one market from the outside, but your obligations depend on what you sell, who buys it, where they are based, how you track them, what evidence you collect, how refunds work, and which vendors touch their data. Founders often assume growth comes first and legal clean-up comes later. That is a dangerous fantasy.
Here is why. The EU has pushed hard on tax digitization, cross-border reporting, consumer protection, and privacy enforcement for years. The European Commission’s VAT One Stop Shop guidance exists because cross-border VAT can become unmanageable fast. The European Data Protection Board’s GDPR guidance and decisions show that data handling is not a side issue. On top of that, recent reporting on late VAT correction limits in the EU court is a reminder that “we will fix it later” may fail once audit windows close.
Founders who get this right earn something more valuable than a checkbox. They earn commercial credibility. Investors ask for clean books. Enterprise buyers ask for data maps, processor lists, and contract terms. Payment providers monitor chargebacks, fraud patterns, and merchant behavior. Tax authorities want records that match your invoices and location evidence. Privacy regulators want lawful basis, transparency, and vendor control. The same internal mess can upset all of them.
My founder bias is simple. Women do not need more inspiration, they need infrastructure. The same goes for founders in general. If your expansion plan depends on heroic manual work, it is not a plan. It is a delayed incident.
What are the fundamentals you need to understand first?
What is VAT in the EU context?
VAT is a consumption tax charged on many goods and services sold in the EU. In cross-border sales, the rules change based on whether you sell B2C or B2B, whether you sell digital services or physical goods, where the customer is located, and whether a marketplace is involved.
Why it matters for startups: one pricing page can expose you to several VAT treatments at once. A SaaS company selling subscriptions to German consumers, French companies, and Italian freelancers may need different tax logic, different invoice fields, and different evidence trails.
Related terms: OSS, IOSS, place of supply, reverse charge, taxable person, VAT ID, invoice records, destination-based tax.
What is GDPR in the startup sales context?
GDPR regulates personal data. Personal data means information linked to an identified or identifiable person, such as names, emails, IP addresses, billing details, device identifiers, HR files, and support conversations. It applies when you collect or use that data for customer acquisition, onboarding, payments, support, analytics, marketing, security, or hiring.
Why it matters for startups: most revenue systems are data systems. Your website cookies, CRM, payment processor, email tool, customer support app, ad platform, and cloud storage all shape your GDPR risk. If you need a practical foundation, build your process around a GDPR compliance step-by-step approach before you expand traffic and spend.
Related terms: controller, processor, lawful basis, consent, legitimate interest, data subject, transfer, retention, deletion, DPIA.
How do VAT and GDPR collide in real operations?
They collide in checkout flows, invoicing, fraud checks, location evidence, account creation, refunds, email receipts, analytics, and customer verification. VAT often requires you to retain records and prove customer location. GDPR requires you to collect only what you need, explain why, secure it, and keep it no longer than justified. That tension confuses many founders.
The answer is not to choose one over the other. The answer is to define why each data point exists, who uses it, where it is stored, and how long it must stay. If you sell across borders without this mapping, your team will improvise. Improvisation is expensive.
Which sales scenarios trigger the biggest VAT and GDPR issues?
- SaaS and digital products sold B2C
You may need to charge VAT based on the customer’s member state and keep location evidence. - SaaS sold B2B
You may need to validate VAT IDs and apply reverse charge rules where valid. - Ecommerce goods sold cross-border
You face distance selling rules, returns issues, customs touchpoints in some structures, and country-based consumer expectations. - Marketplaces and platform sales
The platform may handle part of the VAT chain, but your privacy duties often remain alive in adjacent systems. - Freemium funnels and lead capture
Marketing cookies, email capture, profiling, and CRM syncing create GDPR exposure before money even changes hands. - Mixed bundles
Courses, software, consulting, community access, and templates bundled together can create tax classification confusion and messy legal wording.
Next steps. Before you obsess over ad spend, sort your offer architecture. Founders often create legal chaos by shipping a bundle that accounting, product, and marketing each describe differently.
How do you implement cross-border VAT and GDPR in a startup, step by step?
Phase 1: Assessment and planning
Step 1. Audit your current sales and data flows. Map what you sell, to whom, in which countries, through which payment flows, and with which tools. List website forms, cookies, checkout fields, invoices, CRM fields, support channels, and vendor apps. If you already operate in more than one jurisdiction, add a startup legal checklist by country so your market plan matches local obligations.
- List all products and classify them: digital service, physical goods, service, bundle
- Separate B2B and B2C revenue paths
- List all countries where you already have customers or active marketing
- Map every tool that touches personal data or invoice data
- Document who owns tax, privacy, finance, support, and marketing decisions
Step 2. Define your tax logic. Decide when VAT is charged, when reverse charge applies, how VAT IDs are checked, which evidence proves customer location, how invoices are produced, and which records must be retained.
Step 3. Define your privacy logic. For each data category, write down the purpose, lawful basis, recipient, storage location, retention period, and deletion rule. If vendors process personal data for you, get control over contracts early with data processing agreements.
Step 4. Choose your internal owner. If nobody owns the system, everybody will assume somebody else does. In lean startups, the owner can be the founder, finance lead, or ops lead, but the ownership must be explicit.
Phase 2: Build the foundation
Step 5. Fix the website front door. Your website often breaks GDPR before your product does. If analytics, remarketing, and social pixels fire before valid consent where consent is needed, your data chain starts dirty. Review your banner, preferences, scripts, and policy text through a cookie consent setup that matches your traffic sources and martech stack.
Step 6. Repair checkout. Checkout should collect only what is needed, display the right tax treatment, support invoice requirements, and avoid misleading consent wording. If you ask for business status or VAT ID, validate the logic and test what happens when data is missing or invalid.
- Display prices consistently, tax-inclusive or tax-exclusive as required for your audience
- Collect billing country in a way that feeds tax rules
- Validate VAT IDs for B2B where relevant
- Store location evidence if required for digital services
- Generate invoice data that accounting can actually use
- Remove pre-ticked marketing boxes
Step 7. Make marketing data lawful. Newsletter forms, webinar registrations, lead magnets, and sales outreach are where many startups drift into sloppy consent and overcollection. A focused GDPR for marketers guide helps clean up email lists, suppression logic, ad audiences, and vendor handoffs before your pipeline gets contaminated.
Step 8. Align finance, legal, and product language. Your website copy, invoice labels, terms, refund rules, and internal product codes should describe the same thing. If marketing says “course,” finance says “digital service,” and support says “membership,” tax treatment becomes fragile.
Phase 3: Test, document, and scale
Step 9. Run country-by-country scenario tests. Test orders from Germany, France, Spain, Italy, the Netherlands, Poland, and smaller markets you plan to enter. Use B2C and B2B cases. Test refunds, credit notes, failed payments, plan upgrades, and location mismatches.
Step 10. Document what your team must do when things go wrong. Write short playbooks for invoice corrections, data access requests, deletion requests, refund disputes, and vendor incidents. “We will figure it out when it happens” is not a process.
Step 11. Review your dependencies. Consultancy.eu recently highlighted the need to map suppliers, jurisdictions, and hidden dependencies in digital systems. Their piece on European data and technology sovereignty makes a point founders should take seriously: if you do not know which vendors and jurisdictions sit under your stack, you do not fully understand your legal exposure.
Step 12. Recheck every quarter. New vendors, new pricing, new markets, and new product bundles can change both tax and privacy duties. A system that worked six months ago may already be wrong.
What does a practical founder framework look like across 27 countries?
Let’s break it down. You do not need 27 separate playbooks for day one. You need one structured operating model with local flags.
- One sales taxonomy
Define product types, buyer types, and pricing logic in one internal document. - One data map
List what personal data you collect, why, where, and with whom it is shared. - One invoice standard
Set consistent fields, numbering, correction logic, and storage rules. - One vendor register
Track all processors, subprocessors, contract status, and countries involved. - One incident playbook
Handle DSARs, breaches, invoice mistakes, and refund disputes with scripts and owners. - Local rule flags
Mark markets where language, consumer flows, or tax details need local review.
This approach matches how I think about compliance in product design. People should not need to become mini-lawyers to do normal work. The system should make the right action the default action.
Which best practices actually work in 2026?
1. Treat checkout as a legal product surface
What it is: checkout is not just a conversion asset. It is a tax, privacy, and consumer-law event.
Why it works: most downstream problems start with bad inputs, missing country logic, unclear business status, invalid VAT IDs, or shady consent wording.
- Review every field and justify why it exists
- Test tax outcomes for B2B and B2C in target countries
- Connect invoice output to accounting from day one
Common pitfall: adding fields because a plugin asked for them.
How to avoid it: require a business reason, a legal reason, or a fraud reason for each field.
Metrics to track: tax error rate, invoice correction rate, checkout abandonment by country.
2. Keep a live record of processing, not a dead policy PDF
What it is: maintain a working inventory of data categories, purposes, tools, recipients, retention, and legal basis.
Why it works: when a customer asks for access or deletion, or when a buyer sends a security questionnaire, you answer faster and with fewer contradictions.
- Track every tool that touches leads, customers, and staff data
- Assign an owner for updates
- Review it when adding a new app or workflow
Common pitfall: writing a privacy policy without mapping the real systems.
How to avoid it: map systems first, then write policy text that reflects reality.
Metrics to track: time to answer DSARs, number of unknown tools discovered, vendor contract coverage.
3. Assume returns and refunds are tax and privacy events
What it is: refunds change invoice logic, records, customer communications, and sometimes location or identity evidence.
Why it works: many teams treat returns as support noise, then discover margin leakage, accounting mismatches, and poor customer proof trails. InternetRetailing’s report on new EU returns pressure on cross-border retail points out that returns are moving from customer service into operations. That should already be obvious to founders selling across borders.
- Create a standard refund and credit-note process
- Store all refund communications in one system
- Match refund triggers with tax correction rules
Common pitfall: support issues a refund while finance learns about it later.
How to avoid it: route support actions through a shared system with accounting visibility.
Metrics to track: refund cycle time, credit-note accuracy, cross-border return cost.
4. Build with evidence, not assumptions
What it is: keep proof for tax treatment, consent state, vendor terms, and data handling decisions.
Why it works: audits, complaints, and due diligence reviews reward documented logic. Memory is not evidence. Slack threads are not evidence.
- Retain VAT location evidence where required
- Log consent states and policy versions where relevant
- Archive processor agreements and subprocessor notices
Common pitfall: trusting tools to keep records without checking what can actually be exported.
How to avoid it: run quarterly proof tests. Ask your team to produce records for a sample customer and a sample invoice.
Metrics to track: record retrieval time, percentage of exports complete, audit readiness status.
What founder mistakes create the most damage?
Mistake 1: Treating Europe as one legal bucket
Founders make this mistake because the EU markets itself as a single market. Commercially, that is partly true. Operationally, enforcement, language expectations, invoicing habits, and consumer practices still vary.
The impact: broken customer flows, wrong invoices, local complaints, and support chaos.
- Start with harmonized EU rules, then mark local differences
- Test your top 5 target markets manually
- Review local language and withdrawal wording where relevant
Mistake 2: Leaving VAT setup to accounting after launch
Founders do this because tax feels back-office and boring. Then the front-end ships with the wrong price display, wrong country logic, and no evidence trail.
The impact: underpaid tax, invoice corrections, and messy retroactive repair. Recent court reporting on late VAT correction restrictions should scare any founder who thinks timing does not matter.
- Design tax logic before launch
- Test with real scenarios before paid acquisition
- Keep country evidence and invoice records from day one
Mistake 3: Copy-pasting privacy policies
Founders do this because templates feel cheap and fast. The problem is that templates rarely match your actual vendor stack, retention logic, or marketing behavior.
The impact: false disclosures, buyer distrust, and weak answers to regulator or customer questions.
- Map the systems first
- Write policy text from the map, not the other way around
- Review after every new tool, campaign type, or product launch
Mistake 4: Forgetting vendors are part of your risk
Many startups think “our vendor handles it.” No. Your payment provider, email tool, analytics stack, support desk, and cloud storage can reduce work, but they do not erase your duties as a controller.
The impact: hidden transfers, missing contract terms, conflicting retention rules, and ugly surprises during procurement or fundraising.
- Keep a live vendor register
- Review contracts and processor roles
- Check where data is stored and who can access it
How should you measure success?
Compliance without measurement turns into fake comfort. You need a small dashboard that tells you whether the machine works.
Foundational metrics to track first
- Percentage of sales with correct VAT treatment
- Invoice error and correction rate
- VAT ID validation success rate for B2B sales
- Percentage of vendors covered by signed processor terms
- DSAR response time
- Cookie consent acceptance and rejection rates by country
- Refund and credit-note processing time
Advanced metrics to add after 3 months
- Revenue leakage from tax misclassification
- Country-specific checkout abandonment after tax display
- Average time to retrieve proof for one customer and one invoice
- Percentage of tools with reviewed retention rules
- Enterprise deal friction caused by privacy questionnaires
What should your dashboard include?
- Weekly overview of tax errors and corrections
- Monthly view of data requests and privacy incidents
- Country comparison for checkout and refund patterns
- Vendor review status
- Alert thresholds for anomalies, such as sudden invoice mismatches
Keep it ugly if needed, but keep it real. A spreadsheet you update every week beats a polished dashboard nobody trusts.
How does the approach change by startup stage?
Pre-seed and seed stage
Your reality: limited budget, few people, high uncertainty.
- Focus on a narrow list of EU markets first
- Set up clean checkout, invoices, and vendor records
- Avoid too many tools touching the same customer data
Prioritize: tax logic, privacy basics, consent, contracts, records.
Defer: heavy customization and legal overengineering.
Success looks like: you can sell into a few EU markets without manual panic on every invoice or deletion request.
Series A stage
Your reality: growth is picking up, more hiring, more tools, more channels.
- Formalize owners and review cycles
- Clean martech, sales ops, and support handoffs
- Prepare for buyer security and privacy questionnaires
Prioritize: documentation, vendor controls, country testing, enterprise readiness.
Defer: nothing that blocks clean reporting.
Success looks like: faster sales cycles, fewer invoice fixes, and less founder time wasted on preventable legal firefighting.
Series B and beyond
Your reality: high volume, multiple teams, broader geography, more audits and diligence.
- Standardize systems across business units
- Review local deviations market by market
- Build stronger evidence trails and audit testing
Prioritize: governance, documentation quality, vendor oversight, reporting accuracy.
Defer: manual workarounds that survive only because volume hid the pain.
Success looks like: country growth without country chaos.
What should you do in the next 4 weeks?
Week 1: Map reality
- List products, buyer types, and target EU countries
- Map checkout, invoicing, analytics, CRM, support, and vendor stack
- Identify where tax decisions and data decisions happen
- Choose one internal owner
Week 2: Fix front-end risk
- Review cookie banner and scripts
- Check price display and VAT logic
- Validate invoice fields and refund wording
- Review marketing forms and list sources
Week 3: Repair records and vendors
- Create a live processing record
- Create a vendor register
- Collect missing processor agreements
- Set retention and deletion rules for each tool
Week 4: Test and document
- Run sample orders for B2C and B2B in target countries
- Test one refund, one VAT ID validation, and one deletion request
- Write short internal playbooks
- Set monthly review dates
Glossary of terms founders should know
VAT: Value Added Tax, a consumption tax applied to many goods and services in the EU.
GDPR: General Data Protection Regulation, the EU law governing personal data use and protection.
OSS: One Stop Shop, an EU VAT reporting system that helps businesses report certain cross-border B2C sales.
IOSS: Import One Stop Shop, a system for certain distance sales of imported goods.
Reverse charge: a VAT mechanism where the buyer, not the seller, accounts for VAT in certain B2B transactions.
Controller: the party that decides why and how personal data is used.
Processor: a party that handles personal data on behalf of a controller.
DSAR: Data Subject Access Request, a request from an individual to access or act on their personal data.
Lawful basis: the legal ground that permits personal data processing under GDPR, such as consent, contract, or legal obligation.
Key takeaways
- Cross-border VAT and GDPR management is not admin fluff. It shapes pricing, checkout, invoicing, retention, marketing, and buyer trust.
- The right sequence is simple: map flows, define tax logic, define privacy logic, repair checkout, fix vendors, test by country, document incidents.
- Early-stage founders should keep the system lean. Fewer tools, fewer data copies, cleaner records.
- Your biggest risk is hidden inconsistency. Different teams describing the same sale differently creates tax and privacy trouble fast.
- Founders who embed compliance into workflows sell faster across Europe. Not because regulation is sexy, but because clean systems remove friction.
Final thought. I have spent years working across disciplines where legal, technical, and commercial systems collide. My view has only hardened: protection and compliance should be invisible. If your team needs to remember 40 legal caveats before sending an invoice or launching a campaign, the system is badly designed. Build the rails now, and your startup can cross borders without dragging legal chaos behind it.
People Also Ask:
What is cross-border VAT?
Cross-border VAT is value-added tax that applies when a business sells goods or services from one country to another. In the EU, the VAT treatment depends on where the customer is located, whether the buyer is a business or consumer, and whether the sale involves goods, digital products, or services.
What is the cross-border application of GDPR?
The cross-border application of GDPR covers personal data processing that takes place in more than one country or affects people in more than one country. It often applies when a company operates across several EU states or handles data from EU residents while selling across borders.
Do you have to pay VAT for international orders?
Yes, many international orders can trigger VAT, especially when goods are imported into the EU or sold to customers in EU countries. The amount and who collects it depend on the shipment value, the destination country, and whether the seller is required to charge VAT at checkout.
What are the main GDPR requirements businesses should know?
The main GDPR requirements include lawful and transparent data processing, collecting only the data you need, using data for clear purposes, keeping it secure, honoring user rights, reporting certain breaches, and putting controls in place for data transfers outside the EU.
How do EU VAT rules differ for goods and services?
EU VAT rules for goods usually depend on where the goods are shipped and delivered, while services often depend on the customer’s location and whether the customer is a business or an individual. Digital services sold to consumers usually follow destination-based VAT rules in the EU.
When do you need to register for VAT in multiple EU countries?
You may need to register for VAT in multiple EU countries when you store goods locally, exceed sales thresholds, import goods, or make taxable sales that are not covered by simplification schemes like the One Stop Shop. Your registration duties depend on your sales model and where your customers are based.
What is the EU One Stop Shop for VAT?
The EU One Stop Shop, or OSS, is a filing system that lets businesses report and pay VAT for certain cross-border B2C sales across EU member states through one registration. It can reduce the need for separate VAT registrations in each country for eligible sales.
How does GDPR affect cross-border ecommerce sales?
GDPR affects cross-border ecommerce by setting rules for how customer data is collected, stored, shared, and used. Online sellers must give clear privacy notices, have a legal basis for processing data, protect customer information, and manage consent, cookies, and marketing communications properly.
What are the biggest challenges of selling across 27 EU countries?
The biggest challenges include different VAT rates, invoicing rules, import procedures, language and consumer law differences, and strict privacy duties under GDPR. Businesses also need to track where customers are located and keep accurate tax and data records for each market they serve.
What are practical tips for handling EU VAT and GDPR together?
Practical steps include mapping where you sell, checking where VAT is due, using OSS when available, keeping clean invoice and transaction records, limiting the customer data you collect, updating privacy notices, reviewing cookie consent tools, and working with tax and privacy advisers when your sales model changes.
FAQ
Do non-EU startups need VAT and GDPR controls before they have a local entity in Europe?
Yes. If you sell to EU customers, your obligations can start before you open a subsidiary or hire locally. Tax exposure depends on what you sell and to whom, while GDPR can apply based on targeting or monitoring EU users. This is where the European Startup Playbook helps founders structure expansion more realistically.
How should founders handle the conflict between VAT location evidence and GDPR data minimization?
Treat it as a design problem, not a legal contradiction. Collect only the evidence required for tax treatment, document the reason for each field, restrict access, and set retention rules tied to legal obligations. A useful reference on this overlap is VAT and GDPR overlap.
What is the biggest hidden risk when selling digital products across multiple EU countries?
The biggest hidden risk is inconsistent classification. If product, finance, and marketing describe the same offer differently, you can end up with the wrong VAT treatment, broken invoices, and misleading privacy notices. Standardize naming, bundle logic, and refund terms before scaling paid acquisition.
How often should cross-border VAT and GDPR settings be reviewed?
Quarterly is a practical minimum for most startups. Review sooner if you add a market, payment provider, pricing model, analytics tool, or new bundle. Cross-border compliance usually breaks during change, not during steady state, so tie legal review to operational changes.
Which teams should be involved in EU sales compliance besides finance and legal?
Product, growth, support, revops, and engineering all matter because they control forms, checkout logic, scripts, invoices, and customer communications. Founders should assign one clear owner, but the workflow must be cross-functional. Otherwise, important duties get split across tools with no accountability.
How can startups validate B2B status without creating unnecessary friction at checkout?
Ask only for data that affects tax treatment, such as company name, billing country, and VAT ID where relevant. Validate automatically when possible and create fallback flows for failed checks. Do not force every buyer through the same path if B2B and B2C rules differ materially.
What records matter most during an EU tax or privacy audit?
Auditors usually care about evidence that your decisions were justified and repeatable: invoices, VAT treatment logic, customer location evidence, processor agreements, consent states where relevant, retention rules, and incident handling records. If your team cannot retrieve them quickly, your compliance system is too fragile.
Are marketplaces enough to solve cross-border VAT and GDPR for small sellers?
Not completely. A marketplace may simplify parts of VAT collection or remittance, but it rarely removes your privacy obligations in support, CRM, email, analytics, or off-platform remarketing. Founders should map what the platform handles and what remains their own responsibility.
How should startups prepare for EU customer data requests while keeping finance records intact?
Separate deletion logic from tax retention logic. Some personal data may need to remain in accounting records for legal reasons, while marketing or support data can often be deleted or restricted sooner. Build a response script that explains what was erased, what was retained, and why.
What is the smartest low-budget way to improve cross-border compliance in the next month?
Start with one spreadsheet for products, buyer types, countries, tools, and data categories. Then test checkout, one refund, one VAT ID scenario, and one deletion request end to end. Small teams do better with simple operational controls than with impressive policy documents nobody uses.
