GDPR (General Data Protection Regulation)
The GDPR — Regulation (EU) 2016/679 — is the EU’s data protection law. It governs how organizations collect, use, store, and share personal data, grants individuals enforceable rights over their data, and allows fines of up to €20 million or 4% of global turnover.
Core obligations
Processing needs a lawful basis (consent, contract, legal obligation, legitimate interests, and others). Organizations must honor data subject rights — access, rectification, erasure, portability, objection — typically within one month. Breaches affecting individuals must be reported to the supervisory authority within 72 hours where feasible. High-risk processing requires a data protection impact assessment (DPIA), and larger processors may need a data protection officer (DPO).
For vendors, Article 28 matters most: any processor you use must be bound by a contract with mandatory clauses, and international transfers need a mechanism — adequacy, standard contractual clauses, or binding corporate rules.
GDPR and security standards
Article 32 requires security appropriate to the risk — pseudonymization, CIA of systems, resilience, regular testing — without prescribing technology. ISO/IEC 27001 is widely used as the framework that demonstrates those measures systematically, and EU regulators increasingly expect exactly that kind of documented, risk-based approach.
Frequently Asked Questions
Does GDPR apply to non-EU companies?
Yes — its scope is extraterritorial. Any organization offering goods or services to people in the EU, or monitoring their behavior, must comply regardless of where it is established.
Is ISO 27001 enough for GDPR compliance?
It covers the security obligations of Article 32 well, but GDPR goes further: lawful bases, consent management, data subject rights workflows, DPIAs, processor contracts, and transfer mechanisms. You need both the management system and the data protection processes.
Related Standards
- •Regulation (EU) 2016/679 (GDPR)
- •ePrivacy Directive 2002/58/EC — cookies and electronic communications
Further Reading
Products & Services
Need help with this?
We consult and build across all of these domains — tell us what you are working on.