The easiest way of covering the basics of EU privacy law is to register in one of the countries of the EU. If you are registered in one you are covered by all. This is far simpler then going down the safe harbour route. The UK is quite simple to register with. http://www.ico.gov.uk/