GDPR Overview

GDPR Overview

GDPR is the EU's data privacy law, and it's become the reference point most other privacy regulations around the world get compared to. If your organization touches the personal data of anyone in the EU or EEA — customers, employees, site visitors — there's a good chance it applies to you, regardless of where your company is actually based.

The Two Roles It Covers

GDPR splits responsibility between controllers, who decide why and how data gets processed, and processors, who handle data on a controller's behalf. Both have real obligations, not just the controller. GDPR: Controller vs. Processor Responsibilities covers exactly what each role requires.

The Core Principles Underneath Everything

Four ideas run through the entire regulation: people should know what's happening to their data (transparency), they should have real control over it (access, correction, deletion), organizations have to actually protect it (security), and organizations have to be able to prove they're doing all of this (accountability). The 7 GDPR Principles, Explained Simply breaks these down into the full seven principles GDPR is actually built on.

Who's Covered

GDPR's reach is broader than most people expect — it's not about where your company is headquartered, it's about whose data you're processing and how you're reaching them. Who Is Subject to GDPR? covers the actual triggers, including the common misconception that just having a website reachable from the EU puts you in scope.

What Compliance Actually Involves

Beyond the principles, there's a concrete set of things you have to actually do: establish a lawful basis for everything you process, handle data subject rights requests within real deadlines, know exactly what data you have and where it lives, and have safeguards in place for moving data across borders. What Does GDPR Compliance Actually Involve? covers the full picture, including when a Data Protection Officer becomes mandatory rather than optional.

What Happens If You Get It Wrong

GDPR has real teeth — fines up to €20 million or 4% of global turnover for the most serious violations. GDPR Fines and Penalties: What They Actually Look Like covers the real numbers, including why the average fine is nowhere near the headline cases everyone's heard of. Who Enforces GDPR? covers the actual regulators behind those fines and how cross-border enforcement works.

Where to Start

Preparing for GDPR Compliance walks through the actual sequence of getting compliant, starting with data mapping rather than jumping straight to policies.

Compliance Isn't a One-Time Project

Getting compliant once and never revisiting it is how organizations end up with stale records and quiet gaps that surface during an investigation, not before. Maintaining GDPR Compliance Year-Round covers what actually needs reviewing, and how often.

Building This Alongside Other Frameworks

A lot of organizations run GDPR alongside ISO 27001 and SOC 2, since the underlying discipline — knowing your data, controlling access, documenting evidence — overlaps substantially across all three. Build that foundation once, and each additional framework on top of it requires proportionally less new work than the first one did.

FAQs

What is the difference between a data controller and a data processor under GDPR?
A controller decides why and how personal data is processed — essentially setting the purpose. A processor handles data on the controller's behalf, following their instructions. Both carry distinct legal obligations under GDPR, not just the controller. See GDPR: Controller vs. Processor Responsibilities for what each role actually requires.

Does having a website that EU visitors can access make my company subject to GDPR?
Not automatically. GDPR applies based on whether you're intentionally offering goods/services to people in the EU or monitoring their behavior — not simply because your site is technically reachable from Europe. Who Is Subject to GDPR? covers the actual triggers.

What does GDPR compliance actually require a company to do?
In practice: establishing a lawful basis for each type of data processing, responding to data subject rights requests within set deadlines, maintaining an accurate record of what data you hold and where, and putting safeguards in place for any cross-border data transfers. Full detail: What Does GDPR Compliance Actually Involve?.

When is a company required to appoint a Data Protection Officer (DPO)?
A DPO is mandatory for public authorities, and for organizations whose core activities involve large-scale, regular monitoring of individuals or large-scale processing of special category data. Outside those triggers, appointing one is optional but often still good practice. See What Does GDPR Compliance Actually Involve?.

How much are GDPR fines, and what's a realistic penalty for most companies?
Maximum fines reach €20 million or 4% of global annual turnover for the most serious violations. However, headline cases like Meta or TikTok are outliers — most enforcement actions result in far smaller, low-six-to-low-seven-figure fines tied to ordinary compliance gaps. See GDPR Fines and Penalties: What They Actually Look Like.

Who actually enforces GDPR?
Each EU member state has its own independent Data Protection Authority (DPA) responsible for enforcement. For cross-border cases, a "lead authority" mechanism coordinates investigations across countries. Who Enforces GDPR? explains how this actually works in practice.

Is GDPR compliance a one-time project or an ongoing requirement?
Ongoing. Data inventories, consent records, vendor relationships, and processing activities change constantly, so compliance requires periodic review — not a single setup phase. Organizations that treat it as "done" often develop quiet gaps that surface during an audit or investigation. See Maintaining GDPR Compliance Year-Round.

How often should we review our GDPR compliance program?
Most organizations review data maps, consent mechanisms, and vendor/processor agreements at least annually, with more frequent checks after any major change — new tools, new markets, or new types of data collected. Maintaining GDPR Compliance Year-Round covers what specifically needs revisiting.

Can GDPR compliance work overlap with ISO 27001 or SOC 2?
Yes, significantly. All three require knowing what data you have, controlling who can access it, and documenting evidence of your controls. Building that foundation for GDPR first means each additional framework — like ISO 27001 or SOC 2 — requires proportionally less incremental work.

Where should a company start when preparing for GDPR compliance?
Start with data mapping — identifying what personal data you collect, where it's stored, who has access, and why — before writing policies or building processes. Preparing for GDPR Compliance walks through the recommended sequence.