DATA PRIVACY · GDPR
Most GDPR programmes fail in the same order. They open with a cookie banner and a privacy policy, then stall at the first access request. This is the order that works, and the one step a North American company cannot finish with the paperwork that exists today.
TL;DR
Build the record of processing first. Your lawful bases, your privacy notice, your rights process, your vendor contracts and your transfer register all derive from it. Article 5(2) asks you to demonstrate compliance, so the deliverable is a set of records, not a state of mind.
Sources: Regulation (EU) 2016/679, Articles 12(3), 28(3) and 30(1) · European Commission, SCC questions and answers
Start with two answers, not a policy #
Before anyone writes a word of a privacy notice, settle two questions. They decide which duties you carry and what the programme costs.
What are you, for which data? A controller decides why and how personal data gets used. A processor handles it on a controller’s orders. Almost every software company is both. You control your staff, prospect and website data. You process what your customers load into the product. The two roles carry different duties, so they need separate lines in every record you build.
Does the GDPR reach you at all? Article 3(1) catches you through a branch in the EU. Article 3(2) catches you with no EU presence. It applies when you offer goods or services to people there, or when you watch what they do there. The GDPR overview walks both tests and the markers in Recital 23. Write the answer down with the reasoning. A regulator, a buyer and your own lawyer will each ask for it.
What trips people up
Teams answer the reach question with a shrug and start work anyway. That costs money twice. If Article 3(2) does not reach you, most of this guide is optional. If it does, Article 27 wants a representative in the EU, and the transfer question below turns hard. The answer changes the budget, so settle it on day one.
The record of processing is the spine #
Article 30 asks a controller to keep a record of processing activities. Teams treat it as a filing chore. It is the opposite. Every later step reads from it. A programme built without it rewrites the same facts four times.
Article 30(1) names seven fields. Here is what each one feeds.
| Article 30(1) field | What goes in it | What it feeds later |
|---|---|---|
| (a) Who you are | Controller, any joint controller, the EU representative, the DPO | Articles 13 and 27, and the header of the notice |
| (b) Purposes | Why you hold the data, one line per purpose | The Article 6 basis, one per purpose |
| (c) Categories | Which people, and which data about them | Whether Article 9 applies, and DPIA triggers |
| (d) Recipients | Every vendor and partner who sees it, third countries included | Your Article 28 contract list |
| (e) Transfers | Which third country, and the safeguard you rely on | The Chapter V register |
| (f) Retention | The erasure clock for each category, where you can state one | Article 13(2), and the erasure workflow |
| (g) Security | A general description of your technical and organisational measures | Article 32, and your buyer questionnaires |
Article 30(2) gives a processor a shorter record. Who it acts for. What categories of work it does. Which transfers it makes. A summary of its measures. Build both records if you are both things.
What good looks like
One sheet, one row per purpose, not one row per system. “Run payroll” is a purpose. “The HR platform” is a recipient. Teams that index the record by system cannot state a clean lawful basis. One system serves several purposes, and each purpose needs its own basis.
Article 30(5) lifts the duty for a firm with fewer than 250 staff. The carve-out almost never holds. It falls away in three cases. The work risks people’s rights. It happens other than now and then. It touches special category or criminal record data. Running a product all year is not occasional, so build the record.
Assign a lawful basis, then write the notice #
With purposes on paper, give each one a basis from Article 6(1). Do it inside the record, not in a separate document, so the two never drift apart. Special category data under Article 9 needs a second condition from Article 9(2) on top.
Two bases carry most of the load. Both have machinery worth getting right.
Legitimate interests, with the test on file #
Goal: a written balancing test you can hand over on request.
The EDPB’s Guidelines 1/2024 set three cumulative conditions. You pursue a real interest. The processing is necessary for it. And the person’s rights do not override it. Write all three out per purpose. Article 13(1)(d) then makes you name the interest in the notice, which is the step teams forget.
What goes wrong: the balancing test gets written after a complaint, which is the one moment it carries no weight.
Consent, and the machinery behind it #
Goal: a record of who agreed to what, and a working way to undo it.
Consent has to be free, specific, informed and clear. It also has to be as easy to take back as to give. That means three things you build. A timestamped record of each consent. A withdrawal path that reaches every downstream system. And a rule for what happens to the data afterwards. Consent you cannot evidence is consent you do not have.
What goes wrong: the withdrawal button updates the CRM and misses the warehouse and the email tool.
Now the notice writes itself, because Articles 13 and 14 ask for the record’s contents in plain words. Article 13 covers data you collect from the person, at the moment you collect it. Article 14 covers data you get from somewhere else. It gives you “a reasonable period after obtaining the personal data, but at the latest within one month”. Anyone who buys prospect lists lives under Article 14 and rarely knows it.
Build the three operations that get tested #
Policies are cheap. Three things get tested by a regulator, a customer or a bad week. Your rights process. Your vendor paperwork. Your breach runbook.
The rights operation #
Goal: any request answered inside a month without a fire drill.
You need three things. One inbox that catches requests wherever they arrive. An identity check under Article 12(6), for cases of reasonable doubt. And a repeatable way to pull one person’s data out of every system on the record. Article 12(3) gives you one month. A hard case buys two further months, and only if you tell the person inside the first month. Article 12(5) keeps the answer free, and puts the burden on you to prove a request is excessive.
What goes wrong: nobody can extract one person’s data from the analytics stack, and the month runs out during the search.
The vendor paperwork #
Goal: a signed contract with every recipient in column (d).
Article 28(3) lists eight clauses. Documented instructions. Confidentiality. Article 32 security. Sub-processor conditions. Help with rights requests. Help with Articles 32 to 36. Deletion or return at the end. Audit cooperation. Article 28(2) makes a processor get your written authorisation before it adds a sub-processor. Article 28(4) keeps it fully liable for whoever it brings in. Your own customers will push the same eight clauses at you.
What goes wrong: the record lists 40 recipients and the contract folder holds 12.
The breach runbook #
Goal: a clock that starts on awareness, not on the post-mortem.
Article 32 asks for measures that fit the risk, plus a routine that tests whether they work. That test clause is where an ISO 27001 ISMS does most of the job for you. Article 33 gives a controller 72 hours from awareness to tell the regulator, unless the breach poses little risk to people. Article 34 adds a notice to the people themselves when the risk to them is high. Write down who decides that the clock has started, and name a deputy.
What goes wrong: nobody agrees on when the company became aware, so the 72 hours get argued about after they expire.
Transfers, where North American programmes stall #
Chapter V governs data leaving the EU. This is the step that separates a European programme from ours. The EDPB’s Recommendations 01/2020, adopted 18 June 2021, set six steps:
- Know your transfers. Column (e) of your record already holds this.
- Identify the transfer tools you are relying on. Adequacy, Article 46 safeguards, or an Article 49 carve-out.
- Assess whether the tool is effective in light of all circumstances of the transfer, including the law and practice of the destination.
- Adopt supplementary measures where the tool alone does not reach the EU standard.
- Take the procedural steps those measures need, which may include a word with your regulator.
- Re-evaluate at appropriate intervals. Dated, so you can show when you last looked.
Step two is where the answer splits by destination.
| Where the data lands | Route | What you keep on file |
|---|---|---|
| Canada, private sector under PIPEDA | Adequacy, 2001 decision | A note that the recipient falls under PIPEDA |
| Canada, outside PIPEDA’s scope | No adequacy | Article 46 safeguards and the step 3 assessment |
| United States, on the DPF list | Adequacy, 2023 decision | The listing, and proof you checked it is current |
| United States, not on the list | No adequacy | Article 46 safeguards and the step 3 assessment |
| Anywhere with no adequacy decision | No adequacy | Safeguards, measures, and the re-evaluation date |
Two details cost real money, and almost no article names them.
Canada’s adequacy is partial. The 2001 decision, which the Commission reconfirmed on 15 January 2024, covers private sector bodies under PIPEDA and stops there. Canada is the only country whose adequacy the Commission held to commercial operators. A Canadian recipient outside PIPEDA’s scope needs Article 46 safeguards like any other third country.
The Data Privacy Framework has a renewal you can lapse. A US organisation self-certifies to the Department of Commerce, then re-certifies every year. Miss it and the International Trade Administration takes you off the list. That removes the route your EU customers rely on. Put the renewal date in the same calendar as your audit dates.
What trips people up
If Article 3(2) reaches you, the 2021 standard contractual clauses are the wrong instrument, and the European Commission says so itself. They cover transfers to importers who fall outside the GDPR. The additional set for importers who fall inside it remains in development. Picture a US or Canadian company the GDPR already reaches. It signs the 2021 clauses to satisfy a European customer. That paper does not do the job it looks like it does.
“They do not work for importers whose processing operations are subject to the GDPR pursuant to Article 3, as they would duplicate and, in part, deviate from the obligations that already follow directly from the GDPR.”
European CommissionStandard contractual clauses, questions and answers, question 24
There is no clean answer while the replacement sits in development. The workable position has four parts. Record the analysis. Say in writing why the 2021 clauses do not fit. Sign them where a customer insists, and note that you did so under protest. Then watch for the new set. Put this one in front of a privacy lawyer rather than settling it in a procurement thread.
The assessments and the appointments #
Four duties turn on thresholds. Each deserves a written answer even when the answer is no. “We looked, and here is why not” is the only version that helps you later.
- The impact assessment, Article 35. Needed where processing is likely to result in a high risk. The text names three cases. Broad routine scoring of people by machine with legal or similar effect. Large scale special category or criminal record data. Routine watching of a public place on a large scale. Article 35(7) then sets the contents. A description of the processing. A test of necessity and proportion. An assessment of the risks, and the measures that address them. Your risk assessment method can carry the risk half.
- Prior consultation, Article 36. If the assessment says the risk stays high after your measures, you consult the regulator before you start. It has eight weeks to advise, and six more for a complex case. Build that into the launch plan, or it becomes a launch delay.
- The data protection officer, Article 37. Needed by public bodies. Needed by firms whose core activities call for regular and systematic monitoring of people on a large scale. Needed by firms whose core activities run on large scale special category or criminal record data. Article 37(6) lets it be a staff member or a service contract. Article 37(7) makes you publish the contact details and give them to the regulator.
- The EU representative, Article 27. Separate from the DPO, and often confused with it. If Article 3(2) reaches you, you appoint one in writing, in a member state where your data subjects live. The exemption covers occasional work that leaves out large scale special category and criminal record data and poses little risk.
What keeps it alive #
A GDPR programme decays the moment the record stops matching the systems. Four routines hold it together, and all four read from the sheet you built in step two.
- New system, new row. Route every new tool and every new use of data through the record before it goes live. This one control keeps the rest true.
- Vendor review on a cycle. Check the recipient column against the contract folder, and read every sub-processor notice you were sent.
- Transfer re-evaluation. Step six of the EDPB method. DPF listings and adequacy decisions both move.
- A rights request rehearsal. Run one against your own data once a year and time it. A process nobody has tried is a plan, not an operation.
If you want a certified system to hold this rather than a folder of habits, that is what a privacy information management system does. Start with what ISO 27701 certification is, then how to design and implement a PIMS. One warning before you buy the certificate as a compliance claim. It counts as evidence under Articles 24(1) and 32(1), and it does not reach the Article 42 shortcut. We set out why in ISO 27701 vs GDPR.
Frequently asked questions #
What is the first step in a GDPR implementation?
Settle your role and your reach, then build the Article 30 record of processing. The record holds your purposes, data categories, recipients, transfers, retention and security measures. Every later step reads from it: lawful bases, the privacy notice, the rights process, vendor contracts and the transfer register. Starting with a policy means writing those facts twice.
Do we need a record of processing with fewer than 250 employees?
In nearly every case, yes. Article 30(5) lifts the duty for smaller firms, but the carve-out falls away in three cases. The work risks people’s rights. It happens other than now and then. It touches special category or criminal record data. Running a product all year is not occasional, so most companies land back inside the duty.
Can we use the standard contractual clauses if the GDPR applies to us?
Not the 2021 set, if the GDPR reaches you under Article 3. The European Commission says those clauses do not work for such importers. They would duplicate duties that already apply, and in part deviate from them. An additional set for that case remains in development. Record the analysis, and take the position to a privacy lawyer rather than settling it in procurement.
Do we need both an EU representative and a data protection officer?
They answer different tests. Article 27 asks for a representative whenever Article 3(2) reaches you, subject to a narrow exemption. Article 37 asks for a DPO based on what your core activities involve. Many North American companies need the representative and not the DPO. Decide each one separately and write down the reasoning.
What has to go in a GDPR privacy notice?
Article 13 sets the list for data you collect from the person. Who you are, your DPO if you have one, the purposes and the lawful basis, and the legitimate interests where you rely on them. Then recipients, transfers and safeguards, retention, the rights, the right to complain, whether the person has to give the data, and any automated decision-making. Article 14 covers data from other sources and gives you at most one month to tell the person.
How long do we have to answer a data subject access request?
One month from receipt under Article 12(3), without undue delay. Two further months are available for a complex or high volume request, and only if you tell the person inside the first month why. The answer costs the person nothing. Article 12(5) puts the burden on you to show that a request is manifestly unfounded or excessive before you charge or refuse.
Does ISO 27701 cover a GDPR implementation?
It covers most of the machinery and none of the legal conclusions. A privacy information management system gives you the records, contracts, rights process and review cadence. It does not pick your lawful bases, settle whether Article 3(2) reaches you, or answer the transfer question. It also counts as evidence under Articles 24(1) and 32(1) rather than an Article 42 certificate.
Key takeaways #
- Settle your role and your Article 3 reach before anyone writes a policy. Both answers change the budget.
- The Article 30 record is the spine. Index it by purpose, not by system, or the lawful bases will not line up.
- Give every purpose a basis inside the record, and write the legitimate interests test at the time, not after a complaint.
- Articles 13 and 14 turn the record into the notice. Data from other sources gets at most one month.
- Three operations get tested in real life: rights requests, vendor contracts and the breach runbook.
- Canada’s adequacy stops at PIPEDA. A US listing on the Data Privacy Framework lapses if you miss the yearly re-certification.
- The 2021 standard contractual clauses do not fit an importer the GDPR already reaches. The replacement set is still in development.
- Route every new system through the record. That one habit keeps the programme true.
Build the record once, and let the rest fall out of it #
A compliance manager runs your data flows into an Article 30 record and settles the role and reach questions in writing. The notice, the contracts and the runbooks then come off that record. The same work carries ISO 27701, ISO 27001 and SOC 2, so you evidence it once.
