One regulation, no identical implementation
GDPR is a European regulation, which means the text applies directly in every EU country without each country having to first transpose it into its own legislation. This makes GDPR different from, for example, accessibility rules, which have been translated into national legislation in each country. Yet implementation is not identical everywhere: the regulation allows member states limited room to provide their own interpretation on a restricted number of aspects, and which supervisor you deal with depends on where your business is established.
For a business selling from the Netherlands to customers in multiple EU countries, this mainly means you cannot automatically assume one interpretation applies everywhere the same. Which aspects differ for your business precisely and what that concretely means is for a lawyer or the competent supervisor to assess. This article describes where such differences typically occur, not how they work out for your situation.
Where member states have room for their own choices
GDPR contains a number of topics on which member states may make choices within a margin set by the regulation. A well-known example is the age at which children can give their own consent for the use of online services; that age is not exactly the same in every country. The way in which personal data of employees may be processed can also be regulated slightly differently per country. These are examples of the type of difference that can occur, not a complete list and not a description of the current state for a specific country: you will find that in national implementation legislation or with the supervisor of the country in question.
Establishment and the lead supervisor
If your business is active in multiple EU countries, the question of which supervisor is the actual point of contact also matters. GDPR has a mechanism whereby businesses with establishments in multiple member states generally deal with one lead supervisor, linked to the location of their main establishment. This does not prevent supervisors in other countries from becoming involved in a complaint or dispute. How this works precisely for your business depends on where you are established and how your activities in other countries are structured; that is a question for the Authority for Personal Data or a lawyer, not something this article makes a statement about.
Selling to the EU without an establishment in the EU?
Another scenario is that your business is established outside the EU but does offer products or services to people in the EU. In that case, there may be an obligation to appoint a representative within the EU. Here too: whether that obligation applies to your business and what conditions it must exactly meet is something to determine with a lawyer or the supervisor.
What this means for your record-keeping
Regardless of how the substantive rules work out precisely, selling in multiple EU countries often creates the same practical burden: you must keep your processing register, your privacy statement and your agreements with processors up to date, and do so alongside the other European obligations that may apply to a webshop with own-brand products, such as product safety, packaging and accessibility. see which platforms exist per obligation provides an overview of where which subject is covered.
A large part of that administrative burden does not come from the rules themselves, but from the fact that you must supply the same business data and records repeatedly each time a new country or platform is added. How reglia plays a role in this, and especially what it does not do with your data, is described on the page about how reglia works. For questions about security and the management of data shared between platforms, there is a separate overview on the page about security and data.
Where you sort this out for your business
Whether and how these differences apply to your business depends on where you are established, in which countries you are active, and how your business structure is set up. That is a question you are best to put to a lawyer or to the Data Protection Authority, possibly in combination with the regulator of the other country. Frequently asked questions about how these kinds of topics relate to the rest of your compliance obligations can also be found on the frequently asked questions page.
If you want to know which platforms are available for the different European obligations your business may face, and how they work separately from each other and together with reglia, that is a good starting point to look further.