GDPR applies to any site serving EU visitors and collecting personal data. Core requirements: lawful basis for processing, clear consent for cookies, right to access and delete, mandatory breach disclosure. For a US-focused law firm site, cookie banner plus privacy policy gets you 90% of the way.