GDPR
EU GDPR hub for Regulation (EU) 2016/679: scope, and roles, lawful bases, rights, DPIAs, breach notification, SCC transfers, penalties, and accountability evidence.
Start with one use of : confirm whether the GDPR applies, identify who decides its purposes and means, record the lawful basis, and then connect that activity to transparency, rights, security, risk, supplier, and transfer duties.
Regulation (EU) 2016/679 has applied since 25 May 2018 and is directly applicable EU law. EDPB and supervisory-authority guidance explains how regulators interpret and apply it rather than replacing the legal text. The GDPR also leaves room for Member State rules in areas such as children's consent, employment, public-sector processing, health, research, and penalties, so check the relevant national law and authority procedure before making a local decision.
Start from Article 30-style records: purposes, categories of data subjects and , recipients, retention periods, transfer destinations, and security measures. If an organisation has fewer than 250 staff, record whether Article 30(5)'s limited exception actually applies; it does not cover non-occasional processing, processing likely to create risk, or processing that includes Article 9 or Article 10 data.
For each processing activity, connect the lawful basis to privacy notices, consent or legitimate-interest evidence, rights intake, contracts, access controls, and triggers.
Keep signed role decisions, Article 28 terms, DSAR logs, breach assessments, DPIAs, transfer assessments, SCC modules, and remediation records together.
Check whether is processed in an activity covered by Article 2 and whether Article 3 connects it to the EU. Then name the , any joint controllers, processors, recipients, EU representative, and authority touchpoints for that activity, not for the organisation in the abstract.
Tie each purpose to an Article 6 lawful basis. If Article 9 special-category or Article 10 criminal-offence data is involved, document the additional condition or legal authority. Then align the notice, retention rule, and rights workflow with that decision.
Decide whether a DPO must be designated, whether Article 35 requires a before processing, which Article 32 security measures fit the risk, how breaches will be escalated, and whether Chapter V permits each transfer outside the EEA.
Track GDPR work that has legal or operational timing pressure: rights responses without undue delay and generally within one month under Article 12, with a possible two-month extension for complex or numerous requests; supervisory-authority breach notification without undue delay and, where feasible, within 72 hours under Article 33; DPIAs before high-risk processing; and event-driven transfer reassessments. If Article 36 prior consultation is required and the authority considers the intended processing would infringe the GDPR, it has up to eight weeks to give written advice, may extend by six weeks for complexity, and may suspend those periods while waiting for requested information. Consultation must happen before the processing starts.
New to the GDPR? Start with the processing activity, scope, roles, and lawful basis. If those decisions are already documented, jump to rights, accountability evidence, risk and incidents, transfers, deadlines, or a focused comparison.
Decide whether the GDPR applies to a specific processing activity, who acts as or , which principles and lawful basis govern it, and which additional conditions need investigation.
Turn the processing decision into understandable notices and workable request handling, then apply the additional rules for children, sensitive data, profiling, and significant automated decisions.
Build the records that connect GDPR conclusions to owners, systems, suppliers, retention controls, legitimate-interest assessments, and repeatable compliance work.
Screen high-risk processing before launch, preserve and prior-consultation evidence, operate the separate breach risk tests, and understand supervisory-authority and penalty exposure.
Select and document the Chapter V route for each restricted transfer, assess SCC-based transfers in context, and separate legal deadlines from internal review cadences.
Use comparisons to identify parallel workstreams, not equivalence, and use the FAQ when you already know the GDPR question you need to resolve.
"The PIA is a tool for building and demonstrating compliance to the GDPR."
"Notify a data breach"
"concepts of controller and processor"
"application of the targeting criterion"
"Adequacy decisions allow personal data to flow freely and safely from the European Economic Area"
"Standard contractual clauses for data transfers between EU and non-EU countries."
"Records of Processing Activities (RoPA) under Article 30 GDPR"
"The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1."
Next steps
This GDPR hub is the shared entry point for processing inventory, role mapping, lawful-basis records, rights operations, triage, breach readiness, transfer governance, and accountability evidence.
Answer GDPR scope, role, lawful-basis, rights, breach, , transfer, and penalty questions with cited official sources.
Keep processing records, contracts, assessments, incident logs, SCCs, and control evidence in one governed system.
Align DSAR, breach, , , and transfer work against the operating clocks that matter.
Review your processing map, evidence model, transfer posture, and next implementation steps.