Short answer
The GDPR itself does not change as soon as you also sell to customers abroad. The regulation is a European regulation, not a directive, and therefore applies directly and in the same way in every member state of the EU and the EEA. What does differ is not in the GDPR itself but in the national laws that remain alongside it, such as the rules on cookies, and in practical matters such as the language of your privacy notice and which supervisory authority you contact with a question or complaint.
For an online shop that only sells within the Netherlands, this distinction is often not relevant. As soon as you have visitors or customers in other EU countries, or outside the EU, it is good to know where the common basis ends and where national rules or international transfers come into play.
Why the basis is the same everywhere
Because the GDPR is a regulation, member states do not need to first transpose it into their own legislation, as must be done with a European directive. The rights of data subjects, the legal bases for processing and the obligation to maintain a record of processing activities therefore apply with the same text in Germany, France or Spain as in the Netherlands. Differences in interpretation arise mainly because supervisory authorities in different countries sometimes place slightly different emphasis in their guidelines, something you will find reflected in the publications of the EDPB and the national supervisory authorities themselves.
Where it does differ: cookies and similar technology
The placing of cookies and similar technologies on a visitor's computer does not fall under the GDPR, but under the ePrivacy rules. These are laid down in a directive in Europe, and a directive must be transposed into national legislation in each country. As a result, the way in which consent for cookies must be requested and recorded can differ in detail between countries, even though the starting point is similar everywhere. For an online shop targeting multiple countries, this is one of the few places where the rules actually diverge from country to country, and not just in their interpretation.
Language and information obligation
The GDPR requires that information provided to data subjects must be intelligible, but does not provide a fixed list of mandatory languages. In practice, supervisory authorities look at who visits your online shop: if you actively target customers in Germany, a German-language privacy notice is advisable, simply because the information would otherwise not be intelligible to that target group. This is not a separate legal rule per country, but a practical application of the same requirement that applies everywhere.
Cross-border processing and the competent supervisory authority
When your business is active in multiple EU countries, the question may arise as to which supervisory authority is competent if something goes wrong. The GDPR provides for what is known as the one-stop-shop mechanism: companies with establishments in multiple member states are in certain cases subject to one lead supervisory authority, usually that of the country where the main establishment is located. For a small business with only a Dutch establishment that incidentally sells to foreign customers, this is different from a business with multiple establishments in the EU. The precise details of this are set out in the GDPR itself and in the guidelines of the EDPB; for your specific situation, this is a question for a lawyer or the competent supervisory authority, not something you need to assess yourself.
Sales outside the EU and EEA
A different set of rules applies once customer data leaves the EU and EEA territory—for example, because a supplier, payment provider, or hosting partner is based outside Europe. In that case, it is no longer a matter of differences between EU countries themselves, but of the rules governing transfers of personal data to a country outside the EU/EEA. The GDPR permits this under certain conditions, such as an adequacy decision by the European Commission for the country in question, or supplementary arrangements such as Standard Contractual Clauses. This is one of the points where a data processing agreement with a foreign party deserves specific attention, and which the knowledge base explains by subject for background.
What this means for your register and documents
For the processing register itself, there is no change to the obligation: you keep track of which processing activities take place, for what purpose, and on what legal basis, regardless of which country your customers are in. What is sensible to document, however, is whether and where data leaves the EU/EEA territory, so that this remains clear if a customer, supervisory authority, or insurer asks about it. Anyone who wants to maintain oversight of this without having to do it manually can have this tracked in the overview of where data is stored and how it is protected.
Whether your webshop is just beginning to sell across borders or has been doing so for some time, the key is to make a distinction between what the GDPR itself regulates and what depends on national laws or on transfers outside Europe. Answers to frequently asked questions on this subject, including the source in the official text, can be found in the collection of frequently asked questions.
Would you like to see how this works for your own business without having to spend an afternoon on it yourself? With the free quick-scan, you get an initial indication, and you can then decide for yourself whether a business account is right for you.