GDPR - Compliance Guide

· About GDPR

Key Takeaways

  • GDPR applies extraterritorially to organizations inside or outside the EU that offer goods or services to people in the EU or monitor their behavior, and violations can trigger fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher.[6][13]
  • The regulation has been fully in force since 25 May 2018, but enforcement continues to evolve through EDPB guidance, national decisions, and new 2025–2026 simplification proposals that have not yet changed the core GDPR text.[6][9][12]
  • Controllers and processors must implement privacy by design, lawful bases, transparency, security, data-subject rights, and breach handling, or face administrative fines, orders to stop processing, and other corrective measures.[6][7]
  • Organizations with high-risk processing must conduct Data Protection Impact Assessments and, where required, appoint a Data Protection Officer, especially public bodies and entities whose core activities involve large-scale monitoring or sensitive data processing.[6]
  • 2026 enforcement remains active and material: the CMS Enforcement Tracker reported 2,685 fines with complete information and about €6.11 billion in total fines recorded by March 2026.[1][15]
  • The EU has proposed GDPR-related simplification reforms in 2025, including changes to breach notification and transparency mechanics, but those proposals are still proposals and do not yet replace the current obligations.[9][12][13]

What It Is

The General Data Protection Regulation (GDPR) is Regulation (EU) 2016/679, the EU’s main ruleset for personal data protection, and it governs the processing of personal data of individuals in the European Union by controllers and processors.[6] It is enforced primarily by national data protection supervisory authorities in each EU/EEA member state, coordinated by the European Data Protection Board (EDPB).[7]

The GDPR was adopted on 27 April 2016, entered into force on 24 May 2016, and became applicable from 25 May 2018.[6] It has not been repealed or replaced as of 6 September 2026.[6][12]

The law’s major phase-in milestone was the two-year transition period between entry into force and applicability, which gave organizations time to update contracts, notices, governance, and security controls before enforcement began in earnest on 25 May 2018.[6] No current 2025–2026 amendment has been enacted that changes those foundational dates; the 2025 Digital Omnibus proposals remain proposals.[9][12][13]

Who Must Comply

GDPR applies to any controller or processor established in the EU when processing personal data in the context of that establishment, regardless of where the processing itself takes place.[6] It also applies to organizations outside the EU if they offer goods or services to people in the EU or monitor their behavior within the EU.[6]

There is no general revenue or employee-size threshold for applicability; the trigger is the nature of the data and the relationship to EU individuals, not company size.[6] That means startups, SMBs, and large multinationals can all be in scope if they handle EU personal data.[6]

The GDPR contains limited exemptions for activities outside its scope, including purely personal or household activity and certain law-enforcement or national-security processing governed by other EU or national instruments.[6] Special rules may also apply where member-state law provides sector-specific derogations, but those do not remove the GDPR’s baseline framework.[6]

Core Requirements

  1. Lawful basis and fairness: Personal data processing must rest on a valid legal basis such as consent, contract, legal obligation, vital interests, public task, or legitimate interests, and it must be fair, transparent, and limited to specified purposes.[6]
  2. Transparency notices: Controllers must provide clear privacy information to individuals, including the purposes of processing, legal basis, recipients, retention periods, rights, and whether data is transferred internationally.[6]
  3. Data minimization and retention control: Organizations must collect only data that is adequate, relevant, and limited to what is necessary, and they must not retain it longer than needed for the stated purpose.[6]
  4. Security and privacy by design: Controllers and processors must implement appropriate technical and organizational measures, including risk-based security, confidentiality, resilience, and privacy by design and by default.[6][7]
  5. Data subject rights handling: Organizations must be able to receive and respond to requests for access, rectification, erasure, restriction, portability, and objection within the GDPR timelines and exceptions.[6]
  6. Processor governance: Controllers must use only processors providing sufficient guarantees, put written data processing agreements in place, and flow down confidentiality, security, subprocessing, and assistance obligations.[6]
  7. Breach response: Personal data breaches must be assessed promptly, notified to the supervisory authority where required, and, in high-risk cases, communicated to affected individuals without undue delay.[6]
  8. Accountability and documentation: Organizations must keep records of processing, carry out Data Protection Impact Assessments for high-risk processing, and appoint a Data Protection Officer where the law requires it.[6]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Regulation adopted | 27 April 2016 | GDPR formally adopted by the EU.[6] | | Entry into force | 24 May 2016 | Legal force begins, but most obligations were not yet applicable.[6] | | Application date | 25 May 2018 | Core GDPR obligations became enforceable across the EU/EEA.[6] | | 2025 Digital Omnibus proposals | 19 November 2025 | Proposed simplifications to parts of GDPR were published; they are not yet law.[12][13] | | 2026 enforcement snapshot | March 2026 | CMS tracker recorded 2,685 fines with complete information and about €6.11 billion total fines.[1][15] |

The GDPR’s maximum administrative fine tiers are up to €10 million or 2% of total worldwide annual turnover for certain infringements, and up to €20 million or 4% of total worldwide annual turnover for more serious infringements, whichever is higher.[6] Supervisory authorities may also issue warnings, reprimands, processing bans, orders to comply, and limits on cross-border transfers.[6][7]

How to Comply

  1. Map processing and lawful bases: Build a current data inventory, identify controller/processor roles, classify data, and document the lawful basis for each purpose.
  2. Implement governance and accountability: Assign ownership, maintain records of processing, and establish approval workflows for new products, vendors, and transfers.
  3. Use ISO 27001 as the security backbone: Align access control, asset management, logging, incident response, supplier security, and continuous improvement to ISO 27001-style controls, then map those controls to GDPR Article 32.
  4. Use NIST CSF 2.0 for operational risk management: Apply Identify, Protect, Detect, Respond, and Recover functions to structure breach readiness, vulnerability management, and resilience testing.
  5. Use ISO 42001 where AI systems process personal data: For AI-driven profiling, automated decisions, or model training with personal data, add AI governance, lifecycle controls, human oversight, and change management.
  6. Operationalize rights requests and notices: Create playbooks for access, deletion, correction, objection, portability, and complaint handling, with identity verification and SLA tracking.
  7. Test breach response and DPIA triggers: Run tabletop exercises, define notification decision trees, and require DPIAs for large-scale monitoring, sensitive data, or novel technology.
  8. Review vendors and international transfers: Reassess processor contracts, subprocessor lists, and transfer mechanisms, and confirm transfer impact assessments where required.

Related Regulations

  • The EU AI Act overlaps when AI systems process personal data; it adds separate governance and high-risk system duties, but it does not replace GDPR obligations.
  • The ePrivacy framework overlaps on cookies, communications metadata, and terminal equipment access; in practice, it can impose stricter consent rules alongside GDPR.
  • The NIS2 Directive overlaps for cybersecurity governance; many entities must manage security incidents under both regimes, with different reporting and supervisory structures.
  • The Data Act can intersect with data-sharing and cloud switching obligations, but GDPR still governs the handling of any personal data involved.
  • The Digital Services Act can overlap for platform transparency and ad-targeting practices, yet personal-data processing remains governed by GDPR.

FAQ

Does GDPR apply to companies outside the EU?

Yes, if they offer goods or services to people in the EU or monitor their behavior in the EU.[6] The company’s location does not matter when the targeting or monitoring test is met.[6] Non-EU organizations should expect enforcement through EU representative, transfer, and supervisory authority mechanisms.[6]

Do small businesses have to comply with GDPR?

Yes, if they process EU personal data in scope of the regulation.[6] GDPR does not set a general small-business exemption based on revenue or headcount.[6] The practical burden may be lighter for low-risk processing, but the core duties still apply.[6]

What is the biggest GDPR fine possible?

The maximum administrative fine is €20 million or 4% of global annual turnover, whichever is higher, for the most serious infringements.[6] A lower tier of up to €10 million or 2% of turnover applies to certain other violations.[6] Supervisory authorities can also impose non-monetary sanctions such as processing bans.[6][7]

Is there a new 2026 version of GDPR?

No enacted 2026 rewrite has replaced the current GDPR text as of 6 September 2026.[9][12][13] The European Commission published 2025 simplification proposals that could affect breach notification, transparency, and related mechanics, but those proposals are not yet in force.[9][12][13]

When must a personal data breach be reported?

The current GDPR rule requires notice to the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach, unless the breach is unlikely to result in risk to individuals’ rights and freedoms.[6] High-risk breaches may also require communication to affected individuals.[6] Any future change to that deadline would require enacted amending legislation, which has not happened yet.[9][13]

Sources

Put it into practice

More compliance guides