DATA PRIVACY · GDPR
The GDPR is an EU law with a long reach. It binds companies in Toronto and Austin that never open an office in Europe. Here is what it says, who it catches, and what you build to meet it.
TL;DR
The GDPR guards the personal data of people in the EU, and it follows that data to whoever holds it. Article 3 catches you if you offer goods or services to people in the EU, or if you watch what they do there. The top fine band runs to 20 million euros or 4 percent of worldwide annual turnover, whichever is higher.
Source: Regulation (EU) 2016/679, EUR-Lex, Articles 3, 33, 83 and 99
What the GDPR is #
The General Data Protection Regulation is Regulation (EU) 2016/679. It took over from a 1995 directive. It began to apply on 25 May 2018 under Article 99. The law binds all 27 member states in the same words, so there is one text and not 27 local versions of it.
Two roles run through the law. A controller decides why and how personal data gets used. A processor handles that data on a controller’s orders. A software firm is the controller for its own staff and prospect data. It is the processor for what its customers load into the product. Most duties sit with the controller. Article 28 then pushes a set of them down to the processor through a written contract.
Personal data means any data that relates to a named or knowable person. That covers a name and an email address. It also covers an IP address, a device ID, a cookie ID and a customer number. Article 9 adds special categories. Health, genetics and biometrics used to name someone are in. So are race, politics, religion, union membership, sex life and sexual orientation. Those need a second condition from Article 9(2) on top of a lawful basis.
When the GDPR reaches a North American company #
Article 3 has two limbs. The second one catches firms with no presence in Europe at all. That is the limb a reader in Canada or the United States should study first.
Article 3(1), the establishment test. If you use personal data in the context of the work of a branch in the EU, the GDPR applies. Where the work happens does not matter. An office in Dublin or a sales arm in Berlin does it.
Article 3(2), the targeting test. This limb applies to a controller or processor with no branch in the EU. It bites where the work relates to either of two things:
- Offering goods or services to people in the EU. Payment does not matter. A free tier counts.
- Watching what they do, so far as they do it inside the EU. Analytics, ad pixels, session recording and profiling all land here.
What trips people up
A visitor from Munich who finds your site and buys something does not, on that fact alone, pull you into Article 3(2). The test asks whether you plan to sell to people in the EU. Recital 23 lists the markers. A language or a currency you do not use at home. Prices in euros. A European phone number. Named EU customers. The watching limb is far easier to trip, because a tracking script does not care where the reader sits.
Article 27 then adds a duty that catches firms out. If Article 3(2) reaches you, you name a representative in the EU, in writing. That person or firm sits in a member state where your data subjects live. People and regulators can address it as well as you. Article 27(2) lifts the duty in a narrow case. The work has to be occasional. It has to leave out large scale special category and criminal record data. It also has to pose little risk to people’s rights. Public bodies sit outside the duty too.
The principles, and the six lawful bases #
Article 5 sets seven principles. Read them as the frame that every other duty hangs on.
- Lawful, fair and open. You need a basis, and people need to know what you do.
- Purpose limits. Collect for a stated purpose. Do not drift to a new one without a fresh look.
- Data minimisation. Keep it fit, relevant and no wider than the purpose needs.
- Accuracy. Keep it right, and fix what is wrong.
- Storage limits. Hold it no longer than the purpose needs.
- Integrity and confidence. Guard it against loss and against eyes that have no business on it.
- Accountability. Article 5(2) makes you answer for the other six, and show that you meet them.
That last word turns a privacy policy into a paper trail. A regulator does not ask whether you meant well. It asks you to show the record.
Every use of personal data also needs one of six bases in Article 6(1):
| Article 6(1) basis | What it needs | Where it fits |
|---|---|---|
| (a) Consent | Free, specific, informed, clear, and easy to take back | Marketing email, extra analytics, cookies you do not need |
| (b) Contract | Needed to run a contract with the person, or to take steps before one | Sign-up, billing, delivery of the product |
| (c) Legal duty | Needed to obey a law that binds you | Tax records, records a statute makes you keep |
| (d) Vital interests | Needed to protect a life | Rare outside health and emergency work |
| (e) Public task | Needed for a task in the public interest or official power | Public bodies and those who act for them |
| (f) Legitimate interests | Needed for your interests or a third party’s, unless the person’s rights win the balance | Fraud checks, network security, some direct marketing |
Public bodies cannot lean on legitimate interests for their own tasks. Everyone else can, and most do. That makes the balancing test worth writing down. Pick the basis before the work starts. Record why you picked it. Keep that record. Moving from consent to legitimate interests after someone takes consent back does not work.
The rights you have to serve #
Chapter III gives people eight rights. Your job is a routine that answers each one inside the clock, every time, with no heroics.
| Right | Article | What you hand over or do |
|---|---|---|
| Access | 15 | A copy of the data, plus the purposes, who sees it, how long you keep it, and where it came from |
| Rectification | 16 | Fix data that is wrong, fill in data that is short |
| Erasure | 17 | Delete once the basis falls away, subject to the listed carve-outs |
| Restriction | 18 | Hold the data and pause the work while a dispute runs |
| Notification | 19 | Tell each recipient about a fix, a delete or a pause |
| Portability | 20 | A copy in a common, machine readable form, for consent or contract data you handle by machine |
| Object | 21 | Stop work based on legitimate interests, and stop direct marketing on request |
| Automated decisions | 22 | A human in the loop where a machine alone decides something with legal or like effect |
Article 12(3) sets the clock. You answer without undue delay and inside one month. A hard request buys two more months. You have to tell the person inside the first month why you need them. Article 21(3), the marketing case, has no balancing test at all. The person says stop, and you stop.
What you build #
The GDPR names the artifacts. Six of them carry most of the work.
Records of processing #
Goal: a written map of what you hold, why, who sees it and how long you keep it.
Article 30(5) lifts this duty for a firm with fewer than 250 staff. Read the conditions before you claim it. The carve-out falls away in three cases. The work risks people’s rights. It happens other than now and then. It touches special category or criminal record data. Running a product all year is not occasional, so most firms land back inside the duty.
Data protection impact assessment #
Goal: a risk assessment before high risk work starts, not after.
Three triggers sit in the text. A broad, routine scoring of people by machine with legal or like effect. Large scale use of special category or criminal record data. Routine watching of a public place on a large scale. Your regulator adds a list of its own on top.
Data protection officer #
Goal: decide whether you need one, and write the answer down.
You need a DPO in three cases. You are a public body. Your core work calls for routine, broad watching of people on a large scale. Or your core work runs on large scale special category or criminal record data. Most software firms sit outside all three. Write the reasoning down, because a regulator will ask for it.
Processor contracts #
Goal: a contract with every vendor that touches personal data for you.
Article 28(3) lists the clauses. Written orders. Secrecy. Security. Control over sub-processors. Help with rights requests and with breaches. Deletion or return at the end. Audit rights. Your customers will push the same terms at you for the data they load in.
Security of processing #
Goal: measures that fit the risk, and proof that they work.
The article names encryption and pseudonymisation. It asks you to keep data safe, whole and to hand. It asks you to get it back after an incident. It also asks for a routine that tests whether the measures work. That last clause is why an ISO 27001 ISMS maps onto Article 32 so well.
Breach notice #
Goal: a runbook that starts the clock the moment you know.
Article 33(1) tells a controller to notify the supervisory authority, which most people call the regulator, “without undue delay and, where feasible, not later than 72 hours after having become aware of” the breach. The one out is a breach that poses little risk to people. Article 34 adds a notice to the people themselves when the risk to them is high. A processor tells its controller without undue delay. It gets no 72 hour grace of its own.
“without undue delay and, where feasible, not later than 72 hours after having become aware of it”
Regulation (EU) 2016/679Article 33(1), the breach notice clock
The fines split into two bands. Article 83(4) reaches 10 million euros or 2 percent of worldwide annual turnover for the year before, whichever is higher. It covers controller and processor duties, plus certification and monitoring bodies. Article 83(5) doubles that to 20 million euros or 4 percent on the same basis. It covers the principles, the lawful bases, the rights in Chapter III and the transfer rules in Chapter V. The costly band is the one about what you do with data. The cheaper band is the one about paperwork.
Moving EU data across the Atlantic #
Chapter V governs data that leaves the EU. Three routes exist. An adequacy decision under Article 45, where the Commission rules that a country guards data well enough. Safeguards under Article 46, which in practice means standard contract clauses, binding corporate rules or an approved certificate. Or a narrow carve-out under Article 49, such as express consent.
Here the answer differs on each side of our border, and the difference costs money.
Canada, adequate but only in part #
The Commission adopted an adequacy decision for Canada in 2001. It reconfirmed the decision on 15 January 2024. The decision reaches private sector bodies that fall under PIPEDA, and stops there. Canada is the only country whose adequacy the Commission held to commercial operators. Data bound for a Canadian body outside PIPEDA’s scope does not ride on that decision. It needs Article 46 safeguards like anyone else.
The United States, adequate by self-certification #
No country wide adequacy covers the United States. The EU-US Data Privacy Framework fills the gap. The Commission adopted it on 10 July 2023. It grants adequacy to US firms that self-certify to the Department of Commerce and stay on the list. The Commission ran its first periodic review on 9 October 2024. On 3 September 2025 the General Court threw out a challenge to the framework in Latombe v Commission, T-553/23. The court found that the United States ensured an adequate level of protection. An appeal to the Court of Justice remains open, and two earlier frameworks fell that way.
What good looks like
Keep a transfer register. List every flow of EU personal data out of the EU. Note the route it travels on. Note the date you last checked that route. When a framework falls, you swap the route on a list. You do not rebuild a map from memory.
What is changing, and what to plan against #
The European Commission’s Digital Omnibus package proposes the first broad reopening of the GDPR text. It would narrow what counts as personal data. It would change breach notice thresholds and deadlines. It would add carve-outs for AI training. On 11 February 2026 the European Data Protection Board and the European Data Protection Supervisor published Joint Opinion 2/2026 on the package. They “strongly urge the co-legislators not to adopt the proposed changes to the definition of personal data”.
What trips people up
A proposal is not a law. The Digital Omnibus has to clear the Parliament and the Council before a word of the GDPR changes. The text that comes out rarely matches the text that went in. Build against the law in force. Track the proposal. Do not design a programme around a wording that may never arrive.
Where a certificate fits #
Two questions come up once a programme starts. Does a certificate prove GDPR compliance, and does the security work you already did count for anything?
The short answers are no and yes. No certificate makes you GDPR compliant. Articles 24(3) and 32(3) point at a narrow class of schemes that ISO standards do not reach. We wrote that out in full in ISO 27701 vs GDPR. What a certified privacy information management system does give you is evidence under Articles 24(1) and 32(1). That is where a regulator looks for your technical and organisational measures. For the mechanics, start with what ISO 27701 certification is, then read how to design and implement a PIMS.
If your buyers sit in North America and ask for a report rather than a certificate, the same control work feeds SOC 2. One access review, one change process and one vendor review serve all three.
Frequently asked questions #
Does the GDPR apply to a company with no office in Europe?
Yes, if Article 3(2) catches you. That happens when you offer goods or services to people in the EU, paid or free. It also happens when you watch what they do inside the EU. Analytics and ad pixels aimed at EU users count as watching. A one-off sale to a visitor from the EU, with no sign that you target the market, does not.
What is the maximum GDPR fine?
Article 83(5) sets the top band at 20 million euros or 4 percent of worldwide annual turnover for the year before, whichever is higher. It applies to the principles, the lawful bases, the rights in Chapter III and the transfer rules in Chapter V. Article 83(4) sets a lower band of 10 million euros or 2 percent for most other duties.
Do we need an EU representative?
If Article 3(2) reaches you, Article 27 says yes, in writing, in a member state where your data subjects live. The carve-out covers occasional work that leaves out large scale special category and criminal record data and poses little risk to people. Running a product for EU users all year is not occasional.
Can EU personal data flow to a Canadian company?
It can, on the 2001 adequacy decision, which the Commission reconfirmed on 15 January 2024. The decision covers private sector bodies under PIPEDA and nothing else. Canada is the only country whose adequacy the Commission held to commercial operators. Outside PIPEDA’s scope you need standard contract clauses or another Article 46 safeguard.
How long do we have to report a personal data breach?
Article 33(1) gives a controller 72 hours from the moment it knows, unless the breach poses little risk to people. A late notice still goes in, with reasons for the delay. Article 34 adds a notice to the people affected when the risk to them is high. A processor tells its controller without undue delay.
Does ISO 27701 certification make us GDPR compliant?
No. Articles 24(3) and 32(3) point at approved schemes under Article 42, and ISO certificates run through a different accreditation chain. A certified privacy information management system is still strong evidence of the measures Articles 24(1) and 32(1) ask for. Claim it there, not under Article 42.
Do we need a data protection officer?
Article 37 names three cases. Public bodies. Core work that calls for routine, broad watching of people on a large scale. Core work built on large scale special category or criminal record data. Most software firms sit outside all three. Record the reasoning, because a regulator may ask how you reached it.
Key takeaways #
- The GDPR began to apply on 25 May 2018. It binds anyone who holds the personal data of people in the EU.
- Article 3(2) reaches firms with no EU office through two tests: offering goods or services, and watching behaviour.
- Article 27 then asks for a representative in the EU. The carve-out is narrower than most firms assume.
- Every use of personal data needs one of six lawful bases in Article 6(1), picked before the work starts and written down.
- Rights requests run on a one month clock under Article 12(3), with two more months for hard cases.
- Breaches go to the regulator within 72 hours of the moment you know, under Article 33(1).
- Canada’s adequacy covers PIPEDA bodies only. US firms need the Data Privacy Framework list or Article 46 safeguards.
- The Digital Omnibus is a proposal. Build against the law in force.
Settle whether the GDPR reaches you, then build once #
A compliance manager walks your data flows and settles the Article 3 question in writing. Then they build the records, contracts and runbooks that go with the answer. The same control work carries ISO 27701, ISO 27001 and SOC 2, so you evidence it once.
