Privacy · EU / national DPAs
EU General Data Protection Regulation
Applies the moment you serve EU residents. Lawful basis, rights handling and 72-hour breach notice.
Who it applies to
The businesses that carry GDPR, and the pages written for them.
Each industry page names the regulation, the obligation and the clock, tells the story of an owner in that trade, and shows what we protect for them.
Which packages satisfy it
What it asks for
In plain English, what GDPR expects you to have in place.
- A data mapWhat personal data you collect, why, where it goes and how long you keep it.
- A lawful basis and a noticeA reason for each use and a privacy notice that says so in plain language.
- Rights handlingA process to answer access, correction, deletion and opt-out requests within the required time.
- Security appropriate to the riskTechnical and organizational measures that match the sensitivity of the data.
- Processor and vendor termsContracts that bind the companies processing data on your behalf.
- Breach notificationA tested process to assess a breach and notify the authority and the people affected on the clock the law sets.
A note on authority: the regulator, auditor or certifying body has the final say on whether you comply. We help interpret the requirements, scope what applies, gap-assess against what is published today, and keep you compliance-ready and secure as the guidance evolves. We hold no regulatory authority and do not certify.
Questions we get about GDPR
Do you certify GDPR compliance?
Where do we start with GDPR?
We also need other frameworks. Do we do GDPR separately?
Also in privacy: NIS2 · State privacy · every framework by industry
Next step
Thirty minutes, an engineer, a written scope for GDPR.
Book the demo and see how one control set carries GDPR and everything else you owe. Or leave your details and an engineer replies within one business day.