GDPR compliance means knowing what personal data you process, justifying each use, protecting it and making people’s rights work in practice. It affects websites, apps, employment records, cloud services and many organisations outside Europe. A privacy policy is one part of that system; it must describe the practices your organisation actually follows.
This guide explains the legal requirements and translates them into operational steps, evidence and review tasks. It distinguishes consent from other lawful bases, clarifies notification thresholds and covers processors, international transfers and high-risk processing. Charts use a dated enforcement survey rather than unsupported estimates of business compliance.
What has been updated?
Reviewed October 5, 2026. The legal baseline is Regulation (EU) 2016/679. The Digital Omnibus process is still listed as ongoing in the official legislative procedure; proposed changes must not be treated as applicable rules. National employment, children’s-data, marketing and ePrivacy requirements may add obligations.
What is GDPR and who must comply?
The General Data Protection Regulation has applied since May 25, 2018. It regulates processing of personal data: information relating to an identified or identifiable living person. Processing includes collecting, storing, organising, sharing, analysing and deleting data. Names, account IDs, location information, IP addresses and cookie identifiers can qualify; pseudonymising a record does not automatically make it anonymous.
Article 3 applies to processing in the context of an EU establishment, regardless of where processing happens. It also covers certain organisations outside the EU that offer goods or services to people in the EU, including free services, or monitor their behaviour there. The test is not simply whether someone has EU citizenship or whether a website is accessible from Europe. GDPR protections extend across the EEA through its legal framework; the UK operates a separate UK GDPR regime.
Establishment
An EU office processes customer or staff data in the context of its activities. Overseas hosting does not remove the obligation.
Targeting
A non-EU store actively markets to people in the EU. Assess audience, delivery options, campaigns and other targeting indicators.
Monitoring
A non-EU service tracks people’s behaviour in the EU to analyse or predict their preferences. Assess the actual monitoring activity.
Controller, processor or joint controller?
A controller decides purposes and essential means. A processor handles data on the controller’s behalf under instructions. Joint controllers jointly determine purposes and means and need a transparent allocation of responsibilities. One company may be a controller for its staff records and a processor for customers’ hosted databases. Determine roles by actual conduct, rather than vendor labels.
GDPR has exclusions, including purely personal or household activity, but a commercial site should not assume they apply. For differences between major privacy regimes, see our GDPR, CCPA and CalOPPA comparison.
The seven GDPR principles
Article 5 contains six processing principles and the accountability requirement. Apply them together: a secure database can still be unlawful if you collect unnecessary information or use it for an incompatible purpose.
Lawfulness, fairness and transparency
Identify a valid legal basis, avoid unexpected or harmful uses, and explain processing in language people can understand. An obscure policy cannot fix an unfair collection practice.
Evidence: purpose-by-purpose legal basis register and notices shown at collection.
Purpose limitation
Collect data for specific, explicit and legitimate purposes. Assess whether a new use is compatible with the original purpose; a new analytics or AI project needs its own assessment before launch.
Evidence: documented purposes, change reviews and controls on secondary use.
Data minimisation
Collect only what is adequate, relevant and necessary. Remove optional identity fields from checkout, limit log contents and avoid retaining entire documents when a verification result is sufficient.
Evidence: field-level justifications and periodic collection reviews.
Accuracy
Keep information accurate for its purpose and correct or erase inaccurate records without delay. Give people a reliable correction channel and propagate corrections to relevant recipients.
Evidence: correction workflows, validation rules and recipient notifications.
Storage limitation
Set retention periods or meaningful criteria by purpose. Tax records, support tickets and abandoned accounts may need different schedules. Apply deletion to exports and plan how backups expire.
Evidence: retention schedule, legal-hold rules and deletion records.
Integrity and confidentiality
Match technical and organisational safeguards to risk. Include least-privilege access, secure configuration, authentication, encryption where appropriate, recovery and regular control testing.
Evidence: risk assessments, access reviews, restore tests and incident exercises.
Accountability
Assign responsible owners and demonstrate that safeguards actually work. Keep assessment decisions, contracts, training records and remediation evidence; publishing policies alone is insufficient.
Evidence: an auditable compliance register with owners and review dates.
Choose a lawful basis for each purpose
Article 6 provides six lawful bases; consent is not the default for every activity. Split a customer journey into purposes such as fulfilment, fraud detection, invoicing and optional marketing. Document the appropriate basis for each, its limits and the evidence supporting it before processing begins. Do not switch bases retrospectively simply because someone withdraws consent.
| Lawful basis | Possible use | Assessment and limits |
|---|---|---|
| Consent | A genuinely optional newsletter subscription. | Keep proof of a specific, informed, freely given choice. Withdrawal must be as easy as giving consent; no pre-ticked boxes. |
| Contract | Using a delivery address to fulfil an order. | Processing must be objectively necessary for the contract or requested pre-contract steps. Adding advertising to terms does not make it necessary. |
| Legal obligation | Keeping invoices under applicable tax law. | Identify the EU or Member State obligation that requires the processing, and limit data and retention to that requirement. |
| Vital interests | Sharing necessary data in a life-threatening emergency. | This is a narrow basis for protecting someone’s life, rather than a general justification for routine business processing. |
| Public task / official authority | A legally authorised public service. | Identify the legal foundation and necessity. Being useful to the public does not by itself establish this basis. |
| Legitimate interests | Proportionate fraud prevention or network security. | Document the interest, necessity and balancing assessment, including reasonable expectations, safeguards and the right to object. |
Sensitive information needs another condition
Health, genetic, certain biometric, racial or ethnic origin, political, religious, trade-union and sex-life or sexual-orientation data are special categories under Article 9. Establish an Article 6 basis and a valid Article 9 condition. Explicit consent is one possible condition, but employment, healthcare and other conditions have specific legal requirements. Criminal-offence data has separate Article 10 restrictions.
For legitimate interests, document a three-part assessment: identify a lawful interest, show why the processing is necessary and balance it against people’s rights and interests. Consider less intrusive alternatives, reasonable expectations, vulnerable people and practical safeguards. Public authorities cannot rely on this basis when performing their tasks.
Children and AI require careful assessment
Article 8 sets a default consent age of 16 for information society services offered directly to children where consent is the basis; Member States can lower it to 13. This is not a universal age rule for all processing. For AI projects, assess training and deployment separately, minimise inputs, test whether outputs expose personal data and address significant automated decisions. Neither publicly available data nor an AI model’s output is automatically outside GDPR.
GDPR impact: sourced enforcement statistics
DLA Piper’s January 2026 GDPR fines and data breach survey reports approximately €1.2 billion in fines in 2025, broadly matching 2024. Its breach-notification average rose from 363 to 443 per day, an increase of 22%, for the period January 28, 2025 to January 27, 2026. These are surveyed-jurisdiction figures covering the EEA and UK, rather than a census of every incident.
| Metric | Earlier figure | Latest figure | Interpretation |
|---|---|---|---|
| Approximate annual fines | 2024: €1.2bn | 2025: €1.2bn | Rounded annual values; not a cumulative series. |
| Average daily breach notifications | Previous survey period: 363 | 28 Jan 2025–27 Jan 2026: 443 | Reports to authorities, not all breaches or unique affected people. |
Rounded survey totals; these are annual figures, not cumulative fines.
Two period averages, rather than a daily time series. Reported increase: 22%.
For undertakings, compare the turnover ceiling with €10m or €20m respectively and use the higher maximum. This chart does not predict a penalty.
How to interpret these charts
Fine totals vary with a small number of large cases and appeal outcomes. More notifications do not establish a corresponding increase in all underlying incidents or prove why reports rose. The charts do not estimate how many businesses are compliant, rank national enforcement quality or measure rights-request popularity. The legal-ceiling chart uses Article 83, independently of the survey.
Individual rights and response deadlines
Make rights easy to exercise and route requests to trained staff even when they arrive through ordinary support channels. People do not need to cite a GDPR article. Verify identity proportionately where there are reasonable doubts, search relevant systems and processors, and record decisions. A rights portal is useful, but should not become an unnecessary barrier.
Information (Articles 13–14)
Explain who processes data, why, on what basis, recipients, transfers, retention, rights and complaint routes. For indirectly obtained data, observe Article 14 timing and exceptions.
Access (Article 15)
Confirm processing, provide a copy of personal data and the required supporting information. Search relevant systems and communications; protect other people’s rights when providing the copy.
Rectification (Article 16)
Correct inaccurate information and complete incomplete data where appropriate. Ensure downstream recipients receive corrections unless impossible or disproportionate.
Erasure (Article 17)
Delete where a statutory ground applies, such as data no longer being needed or withdrawn consent with no other basis. Legal obligations, claims and other exceptions can justify limited continued retention.
Restriction (Article 18)
Limit use while accuracy or an objection is assessed, or in other specified circumstances. Mark restricted records so staff and automated jobs cannot use them as normal.
Portability (Article 20)
For automated processing based on consent or contract, provide qualifying data supplied by the individual in a structured, commonly used, machine-readable format. Transfer directly where technically feasible.
Objection (Article 21)
For legitimate interests or public-task processing, assess the person’s situation and the applicable test. An objection to direct marketing requires that marketing, including related profiling, stop.
Automated decisions (Article 22)
Address solely automated decisions producing legal or similarly significant effects. Check permitted exceptions and safeguards, including meaningful human intervention where required; this is not a ban on all profiling.
Article 12 response timetable
Respond without undue delay and normally within one calendar month of receipt. An extension of up to two further months is possible where necessary because of complexity or number of requests; inform the person within the first month and explain why. A calendar month is not a fixed 30-day period. If refusing a request, communicate reasons and complaint/judicial-remedy information within the applicable deadline.
Requests are normally free. A reasonable fee or refusal is possible for manifestly unfounded or excessive requests, and the controller must demonstrate that standard. Additional access copies can also attract a reasonable administrative fee. Keep a documented exception decision rather than rejecting requests solely because they are inconvenient or frequent.
Practical GDPR compliance checklist
Use this checklist as a working register with an owner, evidence location, due date and review trigger. Start with a complete view of data flows, then connect public promises to product controls and staff procedures. Prioritise unlawful processing, exposed data and high-risk activities before cosmetic documentation changes.
Map data and assign responsibility
List website forms, accounts, payment flows, HR records, cookies, SDKs, support tools, analytics and AI services. Record purposes, data categories, people affected, recipients, countries, retention and safeguards. Identify where you act as controller, processor or joint controller.
Deliverable: a data-flow map and records of processing activities (ROPA), with an owner for every activity. The Article 30 exemption for organisations with fewer than 250 employees has exceptions: non-occasional processing, risk to rights, or special-category/criminal-offence data can still require records.
Document lawful bases and notices
Select a legal basis before collecting data; assess special-category conditions and local rules. Match notices to actual workflows, including mobile apps and employee systems. Document legitimate-interest assessments where that basis is used.
Deliverable: a purpose/basis register and versioned notices linked from each relevant collection point. Review notices when vendors, purposes or retention change.
Implement consent and rights workflows
Record consent wording, version, choice, timestamp and withdrawal. Route requests from email, support and other channels into a tracked queue. Identify systems and processors that must help fulfil requests, with proportionate identity verification.
Deliverable: tested consent withdrawal, access, correction, deletion, restriction and marketing suppression workflows. Assign an escalation owner and deadline reminders.
Build privacy into products and retention
Use privacy-protective defaults, limit visibility and permissions, and remove unnecessary fields. Establish purpose-specific deletion schedules, including exports and dormant accounts. Make deletion safe and consistent with legal holds.
Deliverable: product review criteria, a retention schedule and evidence that deletion jobs and backup expiry work. Article 25 applies throughout design and operation.
Assess security and breach readiness
Select controls proportionate to likelihood and severity of harm. Test authentication, patching, access limits, encryption where appropriate, monitoring, backups and recovery. Give staff a rapid incident reporting route.
Deliverable: a security risk register and an exercised breach playbook that records awareness time, notification decisions and follow-up actions.
Review DPO and representative requirements
A DPO is mandatory for public authorities/bodies except courts acting judicially, or where core activities involve large-scale regular and systematic monitoring or large-scale special-category/criminal-offence processing. Headcount alone is not the test.
Deliverable: a documented Article 37 assessment. Provide independence, resources, direct access to senior management and published contact details if a DPO is required. Separately assess the Article 27 EU representative requirement for non-EU organisations, including its narrow exceptions.
Screen for a DPIA before launch
A data protection impact assessment is required where processing is likely to create high risk. Article 35 examples include large-scale sensitive-data processing, extensive significant automated evaluation and large-scale systematic monitoring of public areas. Check local authority lists too.
Deliverable: a DPIA describing processing, necessity, proportionality, risks and mitigations. Consult the authority before processing if unmitigated high risk remains; revisit the DPIA after material changes.
Control processors, contracts and transfers
Assess each provider’s role, instructions, security, subprocessors and international access. Obtain Article 28 terms for processors, allocate Article 26 duties for joint controllers and select valid Chapter V safeguards for relevant transfers.
Deliverable: a vendor register, signed agreements, transfer assessments and a process for approving subprocessor changes and ensuring return or deletion at exit.
Security and personal data breaches
Article 32 requires measures appropriate to risk, considering factors such as the state of the art, implementation cost, processing context and potential harm. Use least privilege, strong authentication, timely patching, secure development, encryption where appropriate, monitored access and tested recovery. Train staff for phishing, misdirected emails, lost devices and accidental disclosure. Security duties extend to processors.
A personal data breach can affect confidentiality, integrity or availability. An exposed customer file, an unauthorised record change or a ransomware outage can qualify even without proof of data theft. Record when you became aware, contain the incident, preserve evidence and assess the people affected, data sensitivity and likely consequences.
| Action | Who acts | Threshold / deadline | Evidence |
|---|---|---|---|
| Inform controller | Processor | Without undue delay after awareness of a personal data breach. | Incident facts and ongoing updates; agreed escalation contacts. |
| Notify authority | Controller | Unless unlikely to create risk; without undue delay and, where feasible, within 72 hours of awareness. | Nature, affected categories/numbers where possible, contact, consequences and measures; reasons for delay. |
| Notify individuals | Controller | Without undue delay when likely to create high risk, subject to Article 34 exceptions. | Clear explanation, likely consequences and protective actions people can take. |
| Document breach | Controller | Every personal data breach, including those not notified. | Facts, effects, remedial action and reasoned risk/notification decision. |
Do not wait for a complete forensic report
Information can be supplied in phases where necessary. The 72-hour window is not a permission to delay an available report. Encryption can reduce risk if it makes data unintelligible and keys remain safe; it does not create a blanket exemption. Other incident laws or contracts may impose separate reporting duties.
Incident workflow
- Step 1
Detect and contain
Escalate quickly, secure systems and record awareness time.
- Step 2
Assess the risk
Identify harm, affected groups and notification thresholds.
- Step 3
Notify and update
Use the correct authority and individual channels; add missing facts promptly.
- Step 4
Recover and learn
Restore safely, document decisions and verify corrective controls.
A useful exercise is a simulated support-platform compromise: verify whether you can identify data and recipients, contact the provider, assess risk and prepare an initial report within the statutory window. Track gaps and retest them.
Vendors and international transfers
Before onboarding a processor, assess its security and ability to help with rights, breaches and deletion. Article 28 agreements must cover the subject matter, duration, nature and purpose, data types and people affected, documented instructions, confidentiality, security, subprocessors, assistance, audit information and return/deletion at the end of services. A generic confidentiality clause is insufficient.
Map where data is stored and who can access it. A provider using an EEA data centre can still involve transfers through a separate overseas support entity or subprocessor. Apply the relevant transfer tests to the actual arrangement. The Commission’s international transfer guidance explains the Chapter V toolkit.
| Route | When it may work | What to check |
|---|---|---|
| Adequacy decision (Article 45) | The destination or relevant sector is covered by an applicable decision. | Exact territorial/sector scope and current validity. For the EU–US Data Privacy Framework, verify the recipient’s active certification and coverage. |
| Appropriate safeguards (Article 46) | For example, standard contractual clauses or approved binding corporate rules where no adequacy route covers the transfer. | Correct parties and SCC modules, destination-law assessment, onward transfers and effective supplementary measures where needed. Signing clauses alone is insufficient. |
| Derogations (Article 49) | Specified exceptional situations, subject to their conditions. | Narrow interpretation and precise prerequisites. Do not use exceptional routes as a routine substitute for structural safeguards. |
The transfer mechanism is separate from the lawful basis for processing. Keep both assessments and revisit them when destinations, access arrangements, subprocessors or legal conditions change. Provide transfer information in notices and agreements, and design an exit route if safeguards cannot be maintained.
Our data processing agreement guide explains the contract’s role. Review end-user licence terms separately when licensing software; an EULA does not replace a processor agreement.
Common GDPR compliance mistakes to avoid
Most failures arise from a gap between written promises and operational behaviour. Use these examples to review product launches, support workflows and procurement decisions.
Copying another company’s policy
Problem: It may name the wrong vendors, purposes and rights contacts.
Action: Build the notice from your inventory and verify every statement with the responsible team.
Treating consent as universal permission
Problem: Bundled consent or a forced checkbox cannot legitimise every use.
Action: Choose the basis per purpose and keep optional marketing distinct from necessary services.
Collecting “just in case” data
Problem: Extra identity, location and behavioural data increases risk and weakens necessity.
Action: Remove unused fields and give each remaining category a purpose, access rule and deletion date.
Assuming hosting location solves transfers
Problem: Overseas support or onward disclosures may remain relevant.
Action: Map entities and access paths, then assess contracts and Chapter V safeguards.
Making rights requests hard to submit
Problem: Exclusive portals or excessive ID checks can obstruct rights.
Action: Accept ordinary channels, verify proportionately and search processor-held data too.
Leaving consent controls untested
Problem: A banner may be present while tracking still runs before consent.
Action: Inspect actual network and storage behaviour before choice, after refusal and after withdrawal.
Treating compliance as finished
Problem: New integrations, AI tools and staff changes can invalidate prior assessments.
Action: Use change-triggered reviews, assigned owners, training and evidence of corrective actions.
GDPR penalties and enforcement
Article 83 sets maximum administrative fines rather than automatic tariffs. Authorities assess matters such as seriousness, duration, affected people, intent or negligence, mitigation, cooperation and previous infringements. For an undertaking, the turnover reference is the preceding financial year’s total worldwide annual turnover; the relevant undertaking may extend beyond a single local subsidiary.
Lower tier: up to €10m or 2%
Whichever maximum is higher. Article 83(4) covers specified obligations including security, records, processor duties, DPIAs and DPO requirements.
Upper tier: up to €20m or 4%
Whichever maximum is higher. Articles 83(5)–(6) cover specified breaches of core principles, rights, international-transfer rules and supervisory orders.
Authorities can also issue warnings, reprimands and orders to change, restrict or stop processing. Individuals may seek compensation under Article 82 where its requirements are met. A breach does not automatically generate compensation; damage and a causal connection matter. Corrective orders can have operational consequences independently of the fine.
A documented transfer enforcement example
The Irish DPC’s TikTok decision announced May 2, 2025 imposed €530 million in fines for transfer and transparency infringements involving EEA user data and China-based access. This is the amount imposed in that decision, rather than a claim about money paid or a final appeal outcome. Its practical lesson is to assess actual access arrangements and explain them accurately to people.
| Risk area | Practical control | Review evidence |
|---|---|---|
| Transfers | Assess recipient entities, remote access and onward transfers. | Transfer map, safeguards and documented assessment. |
| Transparency | Ensure notices match purposes, destinations and actual data flows. | Versioned notices and collection-point checks. |
| Security | Maintain risk-based controls and effective incident procedures. | Access reviews, remediation records and incident exercises. |
| Rights | Operate timely, proportionate request handling across systems. | Request log, search scope, response dates and exception reasoning. |
Tools, resources and ongoing reviews
Use tools to support defined responsibilities. An inventory system helps only if teams update it; a consent manager helps only if it controls every relevant tag; a rights tracker helps only if responses search the right systems. Check access controls, data export, retention and processor terms for compliance tools themselves.
Documentation and operations
Maintain a ROPA, lawful-basis register, retention schedule, consent log, rights queue, vendor register, breach register and DPIA records. Link evidence to named owners so another team member can understand and carry out the procedure.
Training and control checks
Train people for their roles: support handles requests, engineers implement privacy defaults, HR protects personnel records and procurement reviews vendors. Test real tasks instead of relying solely on course-completion numbers.
| When | Review | Useful evidence |
|---|---|---|
| Before a launch or material change | New purposes, vendors, trackers, AI uses and transfer paths; DPIA screening. | Approved change assessment and tested controls. |
| Monthly or at a risk-based frequency | Open rights requests, security alerts, deletion failures and remediation. | Owner sign-off and completed corrective tasks. |
| Quarterly or after major changes | Access privileges, processor/subprocessor changes and notice accuracy. | Review log and updated inventory. |
| Annually and after significant incidents | Training, breach exercise, retention tests and overall governance. | Exercise results, evidence samples and management review. |
Track outcomes you can verify: overdue requests, deletion exceptions, unreviewed vendors and unresolved high-risk findings. Avoid treating an internal checklist score as an official certification. A template or automated scan cannot guarantee compliance; risk and national requirements still need judgement.
Related resources
Frequently asked questions
Your next steps for GDPR compliance
Start by mapping personal data and confirming the purpose and basis for each use. Fix gaps that create immediate risk, assign owners for rights and breaches, review vendor contracts and transfers, then ensure privacy notices describe those arrangements accurately. Keep evidence that consent, deletion and security controls work.
Turn the checklist into recurring responsibilities and a review gate for new products and services. When an activity is likely to create high risk, complete the DPIA before launch and resolve remaining issues. Reliable compliance comes from documented decisions and working safeguards throughout the data lifecycle.