GDPR for companies handling EU personal data
GDPR compliance: the records, rights and safeguards it expects
Who GDPR applies to, the principles behind it, the records you need, how individuals’ rights work, and what happens when there is a breach.
In short
GDPR is the EU’s data protection law. It applies to organisations established in the EU and, in many cases, to organisations outside it that offer goods or services to people in the EU or monitor their behaviour. It asks you to have a lawful basis for each use of personal data, keep records of processing, respect individuals’ rights, protect the data, and report certain breaches to the regulator.
Does GDPR apply to you?
GDPR applies to processing by organisations established in the EU, wherever the processing happens. It also applies to organisations outside the EU when they offer goods or services to people in the EU, or monitor their behaviour there. Most SaaS companies with European users or customers are in scope.
- Controller
- Decides why and how personal data is processed. Usually you, for your own users and staff.
- Processor
- Processes personal data on a controller’s instructions. Usually you, for your customers’ data.
The principles
Article 5 sets out the principles every use of personal data must meet. Most of GDPR’s detailed obligations follow from them.
| Principle | In practice |
|---|---|
| Lawfulness, fairness and transparency | A lawful basis for each use, and clear privacy information |
| Purpose limitation | Use data only for the purposes you collected it for |
| Data minimisation | Collect only what each purpose needs |
| Accuracy | Keep data correct, and fix it when it is not |
| Storage limitation | Set retention periods and delete when they end |
| Integrity and confidentiality | Appropriate security for the data |
| Accountability | Be able to show you meet all of the above |
The records you need
Accountability means documentation. These are the records customers, auditors and regulators ask to see first.
- Record of processing activities (Art. 30)
- Each processing activity, its purpose, data, recipients, transfers and retention.
- Lawful basis (Art. 6)
- The legal ground for each activity, such as contract, legal obligation or legitimate interests.
- Data protection impact assessments (Art. 35)
- Required before processing likely to result in a high risk to people.
- Processor agreements (Art. 28)
- Contracts with every processor and sub-processor that handles personal data for you.
| Activity | Lawful basis | Retention | DPIA |
|---|---|---|---|
| Customer account management | Contract | Life of account + 1 year | Not needed |
| Product analytics | Legitimate interests | 13 months | Done |
| Marketing email | Consent | Until withdrawn | Not needed |
| Fraud screening | Legitimate interests | 2 years | In review |
One row per processing activity, with its lawful basis and retention. Example data, not a customer record.
Individuals’ rights
People can ask what you hold about them and ask you to act on it. You must respond without undue delay and within one month, which can be extended by two further months for complex or numerous requests if you tell the person why.
- Access to their personal data
- Rectification of inaccurate data
- Erasure, in certain circumstances
- Restriction of processing
- Data portability
- Objection, including to direct marketing
- Rights related to automated decision-making
Read our guide to handling data subject requests for a practical workflow.
Security and breaches
Article 32 asks for security appropriate to the risk, such as encryption or pseudonymisation where suitable, the ability to restore data, and regular testing of your measures. This is where SOC 2 and ISO 27001 controls do much of the work.
Do you need a Data Protection Officer?
Only in specific cases: public authorities, organisations whose core activities involve large-scale regular and systematic monitoring of people, and those that process special categories of data on a large scale. Most SaaS companies appoint a named privacy owner instead, and document why a DPO is not required.
GDPR alongside SOC 2 and ISO 27001
SOC 2 and ISO 27001 are about how you protect data. GDPR is about whether you should be processing it at all, and on what terms. The security articles are largely met by the same controls; what GDPR adds is lawful basis, records of processing, individuals’ rights, and contracts with processors.
Building a GDPR programme
Start from the data map; everything else follows from it. How long it takes depends on how many processing activities and suppliers you have.
-
01
Map personal data
What you collect, why, where it flows and which suppliers process it.
Your product, engineering and operations teams
-
02
Lawful basis and records
A lawful basis per activity, recorded in your record of processing activities.
Your team, with legal advice
-
03
Rights, contracts and DPIAs
A process for rights requests, processor agreements in place, DPIAs where needed.
Your privacy owner, with legal and procurement
-
04
Security and review
Article 32 controls, a breach process, and a regular review of the records.
Your security team and privacy owner
Who does what
GDPR has no certifying auditor in common use. The decisions are yours, with legal advice and implementation support where you want them; the records can sit in Certifyi; and the supervisory authority can ask to see them.
| Task | Your team | Certifyi | Supervisory authority |
|---|---|---|---|
| Lawful basis | Decide it, with legal advice | Holds the documented decision as evidence | May ask to see it |
| Records of processing | Keep them current | Holds the current record as evidence | Can request them |
| Rights requests | Respond within the deadline | Holds your request log and responses as evidence | Handles complaints |
| DPIAs | Carry them out | Holds completed DPIAs as evidence | Consulted if high risk remains |
| Breaches | Assess and notify | Incident records and response tasks | Receives notifications |
How Certifyi helps
Keep privacy records next to your security controls
No software makes you GDPR compliant. What Certifyi does is put your privacy evidence and incident records in the same workspace as your ISO 27001 or SOC 2 controls, so the Article 32 security work is recorded once for all of them.
-
GDPR in the catalogue
Adopt GDPR and track its requirements against your controls.
-
Incident records
Log incidents and assign response tasks. Notification deadlines are yours to confirm.
From the blog
GDPR articles
Longer answers to the questions teams ask while they work on GDPR.
Questions
GDPR, answered
Does GDPR apply to my company if we are not based in the EU?
It can. GDPR applies to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour there, regardless of where the company is headquartered.
Is there a GDPR certification?
GDPR allows for approved certification schemes, but no general GDPR certificate is in common use. Compliance is shown through your records, policies, contracts and controls.
What is the difference between GDPR and SOC 2 or ISO 27001?
SOC 2 and ISO 27001 are security frameworks about how you protect data. GDPR is a law about how you collect, use and give people control over personal data. Strong security supports GDPR, but GDPR also needs legal and process work.
What are the penalties?
For the most serious infringements, fines can reach €20 million or 4% of worldwide annual turnover, whichever is higher. Regulators can also order you to stop processing.
Do we need a Data Protection Officer?
Only in specific cases: public authorities, large-scale systematic monitoring, or large-scale processing of special categories of data. Many SaaS companies appoint a privacy owner instead.
What are the first GDPR documents to build?
A record of processing activities with a lawful basis for each activity, and a data map showing where personal data flows, including to sub-processors.
How long does GDPR readiness take?
It depends on how many processing activities, systems and suppliers you have, and what is already documented. We would rather look at those with you than quote a timeline up front.
Does Certifyi make us GDPR compliant?
No software can, because GDPR turns on what you do with personal data. Certifyi holds your incident records and the evidence behind your privacy work, so you can show a regulator or a customer what you did.
Map your data flows in a 30-minute call.
Bring a list of the systems and suppliers that touch personal data. From there we can work out which of your controls already cover Article 32, and where your privacy evidence and incident records would sit beside them.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them