GDPR Compliance
A practical guide to GDPR compliance for businesses handling EU personal data. Understand data subject rights, legal bases, and key requirements.
What is GDPR?
The General Data Protection Regulation (GDPR) is the European Union's comprehensive data protection law. Enacted in 2018, it gives individuals control over their personal data and imposes strict obligations on organizations that process it.
GDPR applies globally — if you handle EU residents' data, you must comply regardless of where your business is located.
Key Definitions
Personal Data
Any information relating to an identified or identifiable person:
- Names, email addresses, phone numbers
- IP addresses, cookie identifiers
- Location data, biometric data
- Health information, financial data
Data Controller
The organization that determines why and how personal data is processed.
Data Processor
An organization that processes data on behalf of the controller.
The Six Legal Bases
You need a lawful basis to process personal data:
- Consent — Freely given, specific, informed, and unambiguous
- Contract — Processing necessary to fulfill a contract
- Legal Obligation — Required by law
- Vital Interests — Protecting someone's life
- Public Task — Official authority or public interest
- Legitimate Interests — Business purposes balanced against rights
Data Subject Rights
GDPR grants individuals powerful rights:
| Right | Description |
|---|---|
| Access | Obtain a copy of their data |
| Rectification | Correct inaccurate data |
| Erasure | Request data deletion ("right to be forgotten") |
| Restriction | Limit how data is used |
| Portability | Receive data in machine-readable format |
| Object | Opt out of certain processing |
| Automated Decision-Making | Challenge automated decisions |
You must respond to requests within 30 days.
Key Requirements
Privacy by Design
Build privacy into systems from the start, not as an afterthought.
Data Protection Impact Assessments (DPIA)
Assess privacy risks for high-risk processing activities.
Records of Processing Activities
Maintain documentation of all data processing operations.
Data Breach Notification
Report breaches to authorities within 72 hours.
Data Protection Officer (DPO)
Required for public authorities and large-scale data processors.
Cross-Border Transfers
Use appropriate safeguards for transfers outside the EU.
Penalties
GDPR has significant fines:
- Lower tier: Up to €10 million or 2% of global annual revenue
- Upper tier: Up to €20 million or 4% of global annual revenue
Major fines have been issued to companies like Meta (€1.2B), Amazon (€746M), and Google (€90M).
How CyberPolicify Helps
CyberPolicify's assessments and policy engine are built around SOC 2, ISO 27001, NIST CSF, and CMMC — frameworks that overlap heavily with GDPR's security expectations around access control, encryption, and incident response (Article 32's "appropriate technical and organisational measures").
- Security foundation — Our cross-mapped controls library and gap analysis, run against the four supported frameworks, build the security fundamentals GDPR expects.
- Core policies — AI-generated security policies (access control, incident response, encryption, and more) cover the common ground, with editable Word export.
- Documented program — The risk register and remediation tracking document your security program over time.
- This guide — Use this page as a plain-English reference to GDPR itself.
Generate documentation mapped to frameworks
Start with policies and procedures aligned to the framework, then close gaps with a clear plan.