LINK-V · Article

EU Subscription Compliance in 2026: VAT OSS and GDPR for a Publication With No Finance Department

August 2, 2026

The same rules apply to a three-person newsroom as to a national outlet. Only one of them has a compliance team to handle it by default. Here's what actually applies at small scale.

What is the VAT One-Stop-Shop threshold?

If your publication sells digital subscriptions to consumers in other EU countries and your total cross-border sales to consumers stay under €10,000 per year, you can charge VAT at your own country's rate and skip OSS registration entirely. Cross that threshold, and you're required to charge VAT at the rate of each individual customer's country, which without OSS registration would mean registering separately in every country you have subscribers in.

What does OSS registration actually involve once you're over the threshold?

One registration, through your own country's tax authority, covers reporting for all 27 EU member states. You file one quarterly return through that single portal instead of separate returns in each country your subscribers live in. It replaces the pre-2021 system, which required exactly the country-by-country registration OSS was built to avoid.

Does GDPR apply differently to a small publication than a large one?

No. GDPR's core obligations , a lawful basis for processing subscriber data , a clear privacy policy , the ability for a subscriber to request their data or its deletion, apply regardless of your organization's size. There's no small-publisher exemption. What differs in practice is who does the work: a large outlet has a dedicated privacy officer, a small one has whoever's available.

Do we need a Data Processing Agreement with our subscription platform ?

If your subscription platform processes subscriber personal data on your behalf, which any platform handling billing , email, or account data does, a DPA is standard practice and often a GDPR requirement depending on your specific setup. Most established vendors provide a standard DPA you sign as part of onboarding rather than something you draft yourself.

What's the actual cost of getting this wrong?

For VAT, incorrect charging across borders creates a tax liability that accumulates quietly until an audit or a customer dispute surfaces it, at which point it's owed retroactively. For GDPR, penalties scale with severity and can be significant, though enforcement against a small publication for a genuine, promptly-corrected mistake looks very different from enforcement against a large company for a systemic failure.

Questions we get asked directly

Do we need to register for OSS if we only have a handful of subscribers outside our own country?

Only once your total cross-border consumer sales pass €10,000 in a year. Below that, you can charge your own country's VAT rate without registering.

Does a US-based subscription platform handle our EU VAT obligations for us?

Not automatically, and not consistently across vendors. Some platforms handle VAT calculation and remittance as part of their service; others leave that obligation entirely with the publication. Check your specific vendor's terms rather than assuming either way.

Is there a size threshold below which GDPR doesn't apply?

No. GDPR applies to any organization processing EU residents' personal data, regardless of size. Enforcement priorities and proportional penalties do vary by severity and intent, but the underlying obligations don't have a size exemption.