GDPR compliance means handling personal data in accordance with the General Data Protection Regulation: using it lawfully, explaining your practices, protecting the information and respecting people’s rights.
For a business, this reaches into everyday work. Registration forms, customer databases, recruitment processes and advertising campaigns can each involve different obligations. Understanding what information you use and why makes those obligations easier to identify.
This guide explains the EU GDPR’s main requirements and how to apply them. National laws can add specific requirements, while the UK GDPR operates as a separate legal framework.
The GDPR has applied since 25 May 2018. It regulates activities involving personal data, including collection, storage, analysis, disclosure and deletion.
Compliance combines legal decisions, working procedures and technical controls. If your organisation promises to delete inactive accounts after a defined period, its systems and staff need to follow that rule.
Accountability also requires evidence: why processing is lawful, what safeguards apply and whether those safeguards work.
The official GDPR text is the primary legal reference. Your obligations depend on your processing activities, role and the risks to individuals.
The GDPR applies to processing carried out in the context of an EU establishment’s activities, regardless of where the processing takes place. It also applies across the European Economic Area through the EEA framework.
Moving a database to an overseas server does not remove these obligations.
An organisation without an EU establishment may fall within scope when its processing relates to:
Offering goods or services to people in the EU, including free services.
Monitoring their behaviour insofar as that behaviour takes place in the EU.
An overseas retailer deliberately targeting customers in EU countries may therefore be covered. Website accessibility from Europe, by itself, does not establish targeting. Citizenship is not the deciding factor.
GDPR covers automated processing and manual records forming, or intended to form, part of a structured filing system.
Purely personal or household activities fall outside scope. Small businesses have no general exemption, although particular obligations have thresholds or exceptions.
Begin by assessing your processing and existing controls. Identify purposes, lawful bases, systems, suppliers and risks before deciding what needs changing.
Turn the findings into a plan with owners and deadlines. Prioritise unlawful processing and risks to individuals. An unnecessary collection may need to stop before its notice is rewritten.
Implement changes in everyday work: revise permissions, configure consent controls, update contracts and train the relevant teams.
Verify the result. Try a sample access request, test deletion settings and check whether rejected tracking stays inactive. Record unresolved problems and corrective actions.
Build privacy review into operational changes. A new supplier, market or product feature can introduce obligations absent from the original assessment.
For detailed review tasks, use our GDPR compliance checklist. Where specialist expertise is needed, our GDPR compliance services guide explains the available types of support.
Personal data relates to an identified or identifiable living person. Identification may be possible from one detail or a combination of information.
Customer records, employee evaluations, location histories and identifiable online activity can all qualify. A business email address identifying an employee can also be personal data.
Category | How GDPR treats it |
|---|---|
Ordinary personal data | Requires a lawful basis and compliance with the general requirements. |
Special category data | Needs an Article 6 lawful basis and an applicable Article 9 condition. |
Criminal conviction and offence data | Subject to separate Article 10 restrictions. |
Pseudonymised data | Remains personal data where additional information can reconnect it to individuals. |
Anonymous information | Falls outside GDPR where individuals are no longer identifiable, considering reasonably likely identification methods. |
Special categories include health data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, sex-life or sexual-orientation data, and biometric data used for unique identification.
Replacing a customer’s name with an account number normally produces pseudonymised data. Consider whether the person remains identifiable through other records or information.
A controller determines why personal data is processed and the essential means of processing. A processor handles it on the controller’s behalf and instructions.
For outsourced payroll, the employer normally decides whose information is processed and why. The payroll provider may act as processor for that work.
Joint controllers jointly determine purposes and means. They must transparently arrange their responsibilities and make the arrangement’s essence available to individuals.
Assess roles for each activity. A supplier may be a processor for customer hosting and a controller for its own billing records. The contract should reflect that reality.
Controllers remain accountable for their decisions. Processors also have direct obligations, including appropriate security and compliance with relevant processing requirements.
Article 5 establishes the principles that guide every processing activity.
Principle | Practical meaning |
|---|---|
Lawfulness, fairness and transparency | Establish a valid legal basis, treat people fairly and explain processing. |
Purpose limitation | Define legitimate purposes and assess whether later uses are compatible. |
Data minimisation | Use only the information necessary for the purpose. |
Accuracy | Correct inaccurate information and update records where necessary. |
Storage limitation | Retain identifiable information only as long as necessary, subject to applicable exceptions. |
Integrity and confidentiality | Protect against unauthorised processing, loss, destruction and damage. |
Accountability | Take responsibility for compliance and retain evidence. |
For an online shop, data minimisation might mean removing an unnecessary date-of-birth field from checkout. Storage limitation might mean deleting abandoned accounts while retaining legally required accounting records separately.
Each decision should follow the purpose of the processing. Information needed to deliver an order does not automatically become available for every future marketing activity.
Choose a lawful basis for each processing purpose before the activity begins.
Article 6 basis | When it may apply |
|---|---|
Consent | Someone freely agrees to a specific, explained use. |
Contract | Processing is objectively necessary for a contract with the person or requested pre-contractual steps. |
Legal obligation | Processing is necessary to meet an applicable EU or Member State legal obligation. |
Vital interests | Processing is necessary to protect someone’s life or another vital interest. |
Public task | Processing is necessary for a public-interest task or official authority grounded in law. |
Legitimate interests | A legitimate purpose and necessity assessment passes the balancing test against individuals’ interests and rights. |
A retailer might use contractual necessity for delivery details and legal obligation for tax records. Advertising requires its own assessment.
Writing an activity into a contract does not automatically make it necessary. Legitimate interests require an assessment of purpose, necessity and effects on individuals.
Public authorities cannot use legitimate interests when performing their public tasks. The EDPB guidance on lawful processing explains the conditions attached to each basis.
When relying on consent, explain the proposed use and give people a genuine choice. Consent must be freely given, specific, informed and unambiguous.
Your process should:
Require a clear affirmative action, without pre-ticked boxes.
Separate distinct purposes where appropriate.
Record what the person agreed to and when.
Make withdrawal as easy as giving consent.
Withdrawal does not invalidate earlier lawful processing. Stop the consent-based activity; retrospectively switching bases simply to avoid withdrawal is inappropriate.
Explicit consent is required in certain situations, including when relying on the Article 9 explicit-consent condition.
For consent-based information society services offered directly to children, Article 8 sets a default parental-authorisation threshold below 16. Member States may lower it to no less than 13. Check the relevant national threshold and make reasonable efforts to verify parental authorisation where required.
National laws implementing the ePrivacy Directive govern storing or accessing information on a user’s device. GDPR governs any resulting processing of personal data.
Consent is generally required for non-exempt storage or access. Exceptions concern technologies strictly necessary for a service explicitly requested by the user or used solely to transmit a communication.
A shopping-cart cookie may qualify for an exemption. Advertising tracking needs a separate assessment under applicable rules.
Where prior consent is required:
Keep the relevant technologies inactive until consent.
Explain purposes and offer meaningful choices.
Apply preferences to cookies, tags and scripts.
Record consent and make withdrawal straightforward.
Test acceptance, rejection and withdrawal, especially after installing new scripts. Check actual network activity rather than relying on the banner’s appearance.
Okito handles website consent work through cookie discovery, preference controls, configured tracking controls and consent records. The organisation remains responsible for its wider data practices.
A GDPR privacy notice should explain your actual processing in language its audience understands. On a website, it often takes the form of a GDPR-compliant privacy policy. Employees and applicants may need separate notices.
Articles 13 and 14 require information such as:
Controller identity and contact details, including representative and DPO details where applicable.
Purposes, lawful bases and relevant legitimate interests.
Recipients, international transfers and safeguards.
Retention periods or the criteria used to determine them.
Individual rights, withdrawal rights and complaint routes.
Relevant automated decision-making, its logic and expected consequences.
Where applicable, whether providing information is legally or contractually required and the consequences of not doing so.
Data categories and sources for indirectly obtained information.
Give the notice at direct collection. For indirect collection, the usual deadline is a reasonable period no longer than one month, or earlier at first communication or disclosure. Specific exceptions apply.
The right that applies, and how a request should be handled, can depend on the lawful basis and circumstances.
Right | What it covers |
|---|---|
Information | Clear explanations of processing. |
Access | Confirmation, a copy of personal data and related information. |
Rectification | Correction of inaccurate data and completion of incomplete data. |
Erasure | Deletion where the legal conditions apply. |
Restriction | Limits on processing in specified circumstances. |
Portability | Certain data provided by the person in a structured, commonly used and machine-readable format, where processing is automated and based on consent or contract. |
Objection | Challenges to qualifying processing; direct-marketing objections must be honoured. |
Automated decisions | Protection against solely automated decisions with legal or similarly significant effects, subject to exceptions and safeguards. |
Respond without undue delay and normally within one month. Necessary extensions of up to two further months require justification based on complexity or the number of requests. Inform the person of the extension and reasons within the first month.
Requests are generally free. Justify refusals or fees and keep identity checks proportionate.
GDPR data mapping identifies what information you hold, its purposes, locations and recipients.
An email address may appear in a CRM, support platform and marketing tool. Understanding these connections makes requests and deletion easier to handle.
Mapping also informs Article 30 processing records. Controller and processor records have different requirements, so record your role alongside each activity.
Define retention periods or criteria by purpose and applicable legal requirements. Establish the starting point, justified exceptions and deletion arrangements across systems and backups.
An unsuccessful application and a payroll record may need different rules. Assign responsibility for applying them so that retention periods become working instructions.
Article 25 requires data protection by design and default. Assess necessary fields, access permissions and retention settings while designing systems.
Article 32 requires security appropriate to the risks. Measures may include encryption, access controls, resilient backups, training and regular testing. Include availability and recovery alongside confidentiality.
A DPIA must precede processing likely to create a high risk to individuals’ rights and freedoms.
Article 35 examples include large-scale sensitive-data processing, certain significant automated evaluations and large-scale systematic monitoring of publicly accessible areas. Check supervisory-authority lists too.
Assess necessity, proportionality, possible harm and safeguards. For a proposed monitoring system, this may mean reducing the information collected or limiting access before deployment.
Where high residual risk remains without sufficient mitigation, Article 36 requires prior consultation with the supervisory authority.
A DPO is required where:
A public authority or body carries out processing, except courts acting judicially.
Core activities require large-scale, regular and systematic monitoring.
Core activities involve large-scale processing of special category or criminal conviction and offence data.
National law may add requirements. Give the DPO independence, adequate resources and access to senior management, and avoid conflicting responsibilities.
Organisations outside the EU covered by Article 3(2) generally need an Article 27 representative.
Exceptions include public authorities and certain occasional processing that is unlikely to create risk and does not involve large-scale special category or criminal-offence data. Assess this separately from DPO appointment.
Choose processors offering sufficient guarantees and establish the required Article 28 terms.
Your data processing agreements (DPAs) should cover instructions, confidentiality, security, subprocessors, assistance with requests and breaches, audits, and deletion or return of information.
Check storage locations, access arrangements and subprocessor practices before approving a supplier. Confirm how you will retrieve records or arrange deletion when the relationship ends.
Chapter V transfer routes include:
Applicable European Commission adequacy decisions.
Appropriate safeguards, including Standard Contractual Clauses or Binding Corporate Rules.
Limited Article 49 derogations where their conditions apply.
With contractual safeguards, assess destination-country laws and practices and whether supplementary measures are necessary. Access by a separate overseas provider can also constitute a transfer.
The EDPB international transfer guidance explains the criteria. Assess transfers alongside the ordinary requirements for lawful processing and security.
A misdirected email, lost device or ransomware incident can involve a personal data breach. Breaches include loss, destruction, alteration and unauthorised access or disclosure.
Contain the incident, establish the facts and assess potential harm.
Action | Requirement |
|---|---|
Processor informs controller | Without undue delay after awareness. |
Controller notifies authority | Unless risk to individuals is unlikely; without undue delay and, where feasible, within 72 hours of awareness. |
Controller informs individuals | Without undue delay where high risk is likely, subject to Article 34 exceptions. |
Controller documents incident | For every personal data breach, including those not notified. |
Explain delayed authority notifications. Where necessary, submit information in phases without undue further delay.
Record the facts, effects, response and notification reasoning. The EDPB breach guidance explains the separate thresholds.
Keep evidence that shows how decisions were applied:
Processing records and lawful-basis assessments.
Current notices, contracts and consent records.
Security tests, training records and breach documentation.
Rights-request decisions and completed corrective actions.
A GDPR compliance audit checks whether this evidence matches everyday practice. It may reveal that a published deletion deadline was never configured in the database.
Set review intervals proportionate to the risks and reassess after significant changes. Record findings, responsible owners and resolution dates so that recurring problems remain visible.
Supervisory authorities can investigate, issue reprimands, order changes and restrict or prohibit processing.
Article 83 sets two main fine tiers:
Up to €10 million or 2% of an undertaking’s preceding financial year’s worldwide annual turnover, whichever is higher.
Up to €20 million or 4%, whichever is higher.
These are ceilings, with the applicable tier depending on the infringement. Authorities assess severity, duration, mitigation and other circumstances.
Individuals can also complain, seek judicial remedies and claim compensation for damage caused by an infringement.
Business size does not determine GDPR’s application. The limited Article 30 recordkeeping exemption does not cover processing that:
Occurs regularly.
Is likely to create risks to individuals.
Involves special category or criminal-offence data.
Routine payroll and customer management can therefore require records even in a small business.
GDPR protection is not determined by citizenship. Consider the following situations:
EU establishment: Processing connected with its activities may be covered regardless of nationality.
Overseas targeting: Offering goods or services to people in the EU can bring related processing within scope.
Behavioural monitoring: Monitoring behaviour occurring in the EU can trigger application.
An EU citizen living abroad does not automatically bring every overseas organisation handling their information within GDPR.
Consent is one of six Article 6 lawful bases. Different purposes may need different grounds:
Order fulfilment: Necessary delivery details may rely on contract.
Statutory records: Tax obligations may justify processing under legal obligation.
Fraud prevention: Legitimate interests may apply following the required assessment.
Optional marketing: Consent may be appropriate or required under applicable rules.
Document the basis before processing. Special category data also needs an applicable Article 9 condition.
GDPR does not universally require double opt-in. A confirmation step can help:
Verify control of an email address.
Reduce mistaken subscriptions.
Strengthen consent evidence.
Keep the relevant wording and confirmation records. Check national electronic-marketing requirements when choosing the subscription process.
Genuinely anonymous information falls outside GDPR. Assess whether identification remains reasonably possible through:
Combining the dataset with other information.
Distinctive location histories or unusual attributes.
A retained key linking records to individuals.
Replacing names with codes usually produces pseudonymised data. The anonymisation process itself involves processing personal data and requires a lawful basis.
GDPR sets no single retention period for all records. Establish:
The category: Invoices, applications or support conversations.
The justification: Why identifiable information remains necessary.
The starting point: Such as account closure or recruitment completion.
The final action: Deletion, anonymisation or justified restricted retention.
Records retained for legal duties or claims should not automatically remain available for unrelated uses.
Transfers outside the EEA are possible where GDPR’s conditions are met. Routes include:
An applicable adequacy decision.
Appropriate safeguards, such as SCCs, with necessary assessments and measures.
Specific Article 49 derogations meeting their conditions.
Check overseas support access and onward transfers as well as hosting. European storage alone does not settle the assessment.
Erasure has exceptions, including necessary retention for:
Applicable legal obligations.
Establishing, exercising or defending legal claims.
Other qualifying purposes specified in Article 17.
Apply exceptions only to the information they justify. Explain any refusal and the person’s options to complain and seek a judicial remedy.
GDPR mandates no universal algorithm or key length. Assess:
The sensitivity and volume of information.
Storage locations and transmission routes.
Key protection and access.
Whether the implementation remains effective.
Combine encryption with appropriate access controls, recovery and testing. HTTPS protects a connection; it does not establish security across databases and internal systems.
Certification can demonstrate conformity within its assessed scope. Check:
Which processing activities it covers.
The scheme and issuer.
Its validity and review conditions.
Responsibilities remain with controllers and processors. ISO 27001 concerns information security management and does not, by itself, prove compliance with every GDPR obligation.
Türkçe
English
