EU GDPR Compliance

Start with the facts that make the GDPR relevant: personal data, a processing purpose, an actor that decides purposes and means or processes on another party's instructions, and a territorial connection through EU establishment, EU-facing offering, or monitoring of people in the EU. Do not treat a vendor list as the role map; the same organisation can be a controller for one workflow, a processor for another, and a joint controller where purposes and means are decided together.

The first evidence record should say what personal data is processed, whose data it is, which entity is controller or processor, which services or countries are in scope, and which planned product or supplier changes would reopen the analysis.

Every processing purpose needs a lawful basis before collection or use. Consent must be evidenced and withdrawable; legitimate interests need the specific interest and balancing rationale; contract, legal obligation, vital interests, and public-task bases should be tied to the exact processing purpose rather than the whole product.

Transparency controls should match the data flow. Notices must identify purposes, legal bases, recipients or categories of recipients, transfers, storage periods or criteria, rights, and complaint routes. For rights handling, maintain an intake, identity-check, search, exemption, response, and completion log so access, rectification, erasure, restriction, portability, objection, and automated-decision requests can be handled within the GDPR response period.

A GDPR compliance file should be organised around processing activities, not departments. The RoPA should identify controller or processor contacts, purposes, data-subject and data categories, recipient categories, third-country transfers, erasure time limits where possible, and a general description of security measures. Organisations with fewer than 250 staff are exempt only where the Article 30(5) conditions are met; non-occasional processing, processing likely to create risk, and processing that includes Article 9 or Article 10 data remain in scope.

Run a DPIA before high-risk processing, especially systematic profiling with significant effects, large-scale special-category data, criminal-offence data, or large-scale systematic monitoring. If residual high risk remains after mitigation, escalate for prior consultation rather than treating the DPIA as complete. Processor contracts should cover documented instructions, confidentiality, Article 32 measures, subprocessor controls, rights assistance, breach and DPIA support, return or deletion, audits, and compliance information.

Screen both controllers and processors for the Article 37 DPO triggers: public-authority or public-body processing other than courts acting judicially, core activities that require large-scale regular and systematic monitoring, or core activities that consist of large-scale Article 9 or Article 10 processing. Union or Member State law may add cases. A designated DPO advises and monitors independently; management and operational owners remain responsible for compliance.

Security and incident response must be connected. Article 32 expects measures appropriate to risk, including confidentiality, integrity, availability, resilience, restoration, and regular testing. The breach workflow should start when the organisation becomes aware of a personal-data breach, triage risk to individuals, preserve facts, involve processors quickly, and decide whether supervisory-authority or data-subject notification is required.

International transfers need a separate control from vendor onboarding. Identify the recipient country, transfer role, transfer tool, onward-transfer chain, and whether an adequacy decision, SCCs, binding corporate rules, or another Article 46 mechanism is being used. Where SCCs are used, keep the transfer assessment and recipient-country risk review with the contract record.

GDPR enforcement risk is not limited to fines. Supervisory authorities can investigate, order compliance, restrict processing, suspend data flows, and impose administrative fines. Article 83 ties fines to factors such as gravity, duration, intentional or negligent character, mitigation, responsibility, previous infringements, cooperation, affected data categories, notification, and aggravating or mitigating factors.

For an undertaking, the highest fine tier reaches up to EUR 20,000,000 or 4% of total worldwide annual turnover for the preceding financial year, whichever is higher, for infringements including basic processing principles, data-subject rights, and transfer rules. A lower tier reaches up to EUR 10,000,000 or 2% for obligations including controller and processor duties in Articles 25 to 39. These are statutory ceilings, not automatic penalties; authorities apply the Article 83 factors in the circumstances of each case. Escalate before launch when a control owner cannot prove lawful basis, notice accuracy, rights handling, retention, processor terms, transfer safeguards, breach readiness, or security testing.