GDPR

Yes. Under Art. 3, GDPR applies to any organisation, wherever established, that offers goods or services to individuals in the EU/EEA or monitors their behaviour. A US or Asian company with no EU office can still be fully in scope and may need to appoint an EU representative under Art. 27.

Every processing activity needs one of the six lawful bases in Art. 6 (consent, contract, legal obligation, vital interests, public task, or legitimate interests). Legitimate interest is available when you have a genuine business need that is not overridden by the individual's rights, but you must document a Legitimate Interests Assessment (LIA) balancing test. It cannot be used to justify processing people would not reasonably expect, and it is generally unsuitable for sensitive data or intrusive tracking.

A Data Protection Impact Assessment is mandatory when processing is likely to result in a high risk to individuals — for example large-scale profiling, systematic monitoring of public areas, processing of special-category data at scale, or many AI and automated-decision systems. National DPAs publish lists of operations that always require one. If the DPIA shows residual high risk you cannot mitigate, you must consult your supervisory authority before starting.

A DPO is mandatory if you are a public authority, if your core activities involve regular and systematic large-scale monitoring, or if you process special-category or criminal-offence data at large scale. Many organisations appoint one voluntarily as good practice. The DPO must be independent, report to the highest management level, and cannot be penalised for performing the role.

Verify the requester's identity, then provide a copy of their personal data and the required contextual information (purposes, recipients, retention, sources) within one month, free of charge in most cases. The deadline can be extended by two further months for complex or numerous requests, provided you inform the individual. Have a repeatable process to locate data across all systems, and redact third-party information appropriately.

Schrems II invalidated the Privacy Shield and confirmed that Standard Contractual Clauses remain valid only if the data receives essentially equivalent protection in the destination. For transfers to non-adequate countries you must use the 2021 SCCs (Decision 2021/914), perform a Transfer Impact Assessment, and add supplementary measures (such as encryption) where local law undermines the safeguards. Transfers to certified US organisations can now rely on the EU-US Data Privacy Framework adopted in 2023.

You must notify the competent supervisory authority within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to individuals. The notification should describe the nature of the breach, the categories and approximate numbers affected, the likely consequences, and the measures taken. If the breach is likely to cause high risk, you must also inform affected individuals without undue delay, and you must log the incident internally regardless of whether it is reportable.

GDPR applies to any personal data used to train, fine-tune, or run AI systems, so you need a documented lawful basis for the training data and must respect purpose limitation and data minimisation. High-risk AI and large-scale profiling typically require a DPIA, and you must be transparent about the logic involved. Where AI makes solely automated decisions with legal or similarly significant effects, Art. 22 gives individuals the right to human intervention and to contest the outcome.

Non-essential cookies and similar tracking technologies generally require prior, freely-given, specific, informed, and unambiguous opt-in consent — pre-ticked boxes and cookie walls that force acceptance are not valid. Users must be able to reject as easily as they accept, and you must be able to demonstrate that consent was obtained. The ePrivacy rules operate alongside GDPR, so a legitimate-interest basis is not usually available for advertising or analytics cookies.

GDPR sets no fixed retention period; instead the storage-limitation principle requires you to keep data only as long as necessary for the purpose it was collected for. You should define, document, and enforce retention periods per data category, justified by business need or legal obligation, and then securely delete or anonymise data. A written retention schedule is the practical way to demonstrate compliance.

There are two tiers: up to €10M or 2% of global annual turnover for lower-level breaches (e.g. records, security), and up to €20M or 4% of global annual turnover for more serious breaches (e.g. core principles, lawful basis, data-subject rights) — whichever is higher. Regulators weigh factors such as the nature, gravity, and duration of the infringement, whether it was intentional, mitigation efforts, and cooperation. Fines are not automatic, but non-compliance can also trigger orders to stop processing, which is often more disruptive.

A controller determines the purposes and means of processing personal data, while a processor acts only on the controller's documented instructions. Controllers carry primary accountability, but processors have direct obligations too — including security, sub-processor controls, breach notification to the controller, and assisting with data-subject rights. The relationship must be governed by a written Data Processing Agreement (Art. 28).

No. GDPR applies regardless of organisation size or profit motive whenever you process the personal data of individuals in scope. Small organisations get limited relief — for example, those under 250 employees are exempt from parts of the record-keeping duty unless processing is not occasional, is high-risk, or involves special-category data — but the core principles, rights, and breach rules still apply.