General Data Protection Regulation (GDPR) Assessment

GDPR applies if your organization is established in the EU, offers goods or services to individuals in the EU, monitors the behavior of individuals in the EU, or otherwise falls under Member State law in a relevant context. The European Commission explains that GDPR can apply even to organizations outside the EU when they target or monitor people in the EU.

Under Article 27, organizations outside the EU that are caught by the GDPR's extraterritorial scope must generally designate a representative in the EU, unless their processing is occasional, low-risk, and does not involve large-scale special category or criminal offense data. Organizations operating across multiple Member States should also identify their main establishment, which determines the lead supervisory authority under the one-stop-shop mechanism.

Data mapping and classification are foundational to GDPR compliance: accountability under Article 5(2) and the Article 30 records requirement are far easier to meet when you know what personal data you collect, where it comes from, where it flows, who has access, and how long it is retained.

Under Article 6, every processing activity must rely on one of six lawful bases: consent, contract, legal obligation, vital interests, public task, or legitimate interests. Where you rely on legitimate interests, a documented balancing assessment is expected. Special category data additionally requires a separate Article 9 condition on top of the Article 6 basis. The basis relied on should be identified and documented before processing begins.

Under Articles 4(11) and 7, valid consent must be freely given, specific, informed, and unambiguous, given by a clear affirmative act and granular, so that separate purposes get separate consents. Withdrawing consent must be as easy as giving it, and individuals must be told of the right to withdraw before consenting. You must also be able to demonstrate that valid consent was obtained.

Articles 12, 13, and 14 GDPR require that privacy notices should be clear, accessible, understandable, and include the required details on identity, purposes, lawful basis, recipients, transfers, retention, rights, complaints, and, where relevant, automated decision-making.

GDPR gives individuals rights, including access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making.

Article 30 GDPR requires controllers and processors to maintain records of processing activities (ROPAs) covering purposes, categories of data and data subjects, recipients, international transfers, retention periods, and security measures, among other elements.

Article 32 requires security appropriate to the risk, taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of processing.

It covers Article 28 processor terms and Articles 45–49 transfer mechanisms such as adequacy decisions, SCCs, BCRs, and derogations. The European Commission also highlights that international transfers require appropriate safeguards.

DPIAs are required under Article 35 GDPR, where processing is likely to result in a high risk to individuals’ rights and freedoms, including in cases such as profiling, large-scale sensitive-data processing, public monitoring, certain children’s data processing, or novel technologies.

Under GDPR, a DPO is mandatory in certain cases, including public authorities, large-scale regular and systematic monitoring, or large-scale processing of special categories of data. The EDPB provides guidance on DPO appointment and role expectations.

It covers Article 21 objections and Article 22 automated decision-making under the GDPR. Individuals must be able to object in certain cases, and organizations relying on Article 22 exceptions need safeguards, including human intervention, transparency, and challenge rights.

GDPR generally requires notifying the supervisory authority within 72 hours when a notifiable personal data breach occurs, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. High-risk breaches may also require communication to affected individuals.

It is built around GDPR accountability and demonstrability. In practice, evidence matters for supervisory authority inquiries, internal audits, and risk management.