No it actually doesn't. It just needs someone in the company executive to not have their head up their ass, and read the law, which is fairly straightforward.

Also, it needs your company's business model to not be selling user data. That's why American companies find it hard to comply with.