> I do wonder how the EU is supposed to be enforce penalties on a company outside of the EU

Realistically, they can't and won't unless it's a very large scale that's worth pursuing, for a multi-national corporation with enough money to pay a big fine. If a company is not doing business in the EU, not selling into the EU, they can of course entirely ignore the GDPR.

In the case of a large company that sells into the EU, and refuses to obey GDPR, what you'd likely see is the EU pursuing that company on its domestic turf legally. A company out of NYC for example could be pursued in a court there for fines related to GDPR violations. The larger those violations, the more likely it'd be pursued by the EU across the Atlantic. This is how it works already, there's a lot of international business precedence. The stronger the legal system in the home country you're pursuing the multi-national into, the better for the EU's case.

If I set up a business in Germany, dump large amounts of toxic waste and cause very costly environmental damage, and then (somehow) quickly flee the country leaving no assets or business behind - but back in NYC my company has vast assets, you'd find the company pursued from Germany to its home in NYC for those damages. They still have to win the case of course.

The EU fortunately wasn't dumb enough to attempt a global claim on regulating privacy. They pushed the line pretty far, but did not cross their own boundaries. I think they fully understood there was no scenario where the US and China (40% of the global economy) - or frankly most nations - were going to care about EU law projections external its jurisdiction.

It depends. When Canada's anti-spam law was introduced in 2014, the intent was to allow a private right of action effective July 1, 2017. This would theoretically mean US/foreign companies could be dragged into class-action lawsuits in Canada. This private right of action was delayed and is currently under review, but nevertheless anyone marketing to Canadians is subject to CASL laws, regardless of where their business is located. We'll see what happens, but if/when the private right of action is implemented it could potentially be a big deal.

IANAL but I can imagine a similar situation happening with GDPR.

According to art. 27 GDPR, affected data processors outside the EU have to establish a data privacy representative in the EU.

In addition, authorities could for example seize local servers in the case of non-compliance. In many EU countries including Germany, data privacy violations can also be prosecuted as criminal offenses.

But this doesn't answer my question: I'm running a little side project here in Australia but with customers who happen to be in the EU. I have nothing in the EU - no sales office or support in Ireland, no hosting anywhere in the EU. How is the EU supposed to mandate that I do anything?

The EU can (and in fact does) mandate that you comply with the GDPR. It cannot, however, enforce compliance since there is limited legal leverage. The Australian government is unlikely to help the EU to bring a case unless there'd be a treaty or an agreement (Safe Haven laws in the US for example). They could theoretically go via your revenue stream and seize your European customers payments or hold you or any officer of your company liable if you ever set foot on European soil or hold any assets that your company has in or moves via Europe. That's all very unlikely to happen over minor infractions, but some business folks already had their private jets impounded for outstanding payments as for example the Thai Prince learned the hard way: http://www.airliners.de/kronprinzen-boeing-in-muenchen-besch... (sorry, german only, but google translate should correctly translate the gist of the story)

All of this is nothing new, it's been working like that for centuries, back when business correspondence was still on old-fashioned paper.

As long as you don't go on holiday to Rome, you'll be fine.

I have the feeling nobody knows this. To me it seems this part of GDPR is particularly targeted at major companies and they can be held accountable through subsidiaries or branch offices in the EU. It doesn't seem very likely to me that small businesses that happen to sell to EU customers too will be the primary target of enforcement anytime soon.