GDPR,
linked to your security.

GDPR compliance: build a decision process around personal data

A customer record copied into a support tool can change who accesses personal data, where it travels and how long it remains available. GDPR compliance depends on recognising those changes before they become routine. The practical objective is to make lawful decisions repeatable across product, operations, HR, procurement and security.

Start with a real activity rather than a template: recruiting someone, delivering a service or investigating fraud. Establish why information is needed, what people should expect and how the organisation will demonstrate that its choices remain justified.

Who the regulation applies to

The GDPR covers processing in the context of an EU establishment's activities, whether the processing itself happens inside or outside the Union. Under Article 3, it can also cover organisations outside the EU offering goods or services to people in the Union or monitoring their behaviour there. Citizenship alone is not the test.

Controllers determine the purposes and means of processing. Processors act on a controller's behalf. These roles follow actual decisions, not just contract labels; the same organisation may hold different roles for different activities. Joint decisions may also require assessment of joint controllership.

There is no general small-business exemption. The Article 30 exception for organisations employing fewer than 250 people is limited: it does not cover processing that is non-occasional, likely to create a risk to rights and freedoms, or includes specified sensitive or criminal-offence data. Assess the activity rather than assuming headcount settles the issue.

Requirements beyond a processing inventory

Article 5 establishes principles including purpose limitation, data minimisation, accuracy, storage limitation, security and accountability. Article 6 requires a lawful basis. Consent is one option, not a default answer for every activity; special-category data also requires an applicable Article 9 condition.

Translate these requirements into decisions teams can execute:

• Specify the purpose and lawful basis before collecting information.
• Remove fields that are unnecessary for that purpose.
• Give clear information under Articles 13 or 14, as applicable.
• Define retention periods or criteria and implement deletion routines.
• Make rights requests actionable across connected systems.
• Record why technical and organisational safeguards are appropriate.

Article 25 requires data protection by design and by default. Include privacy review when choosing a supplier, launching a feature or expanding access. Article 32 calls for security appropriate to risk, including regular testing and evaluation where appropriate. A security certificate does not establish that every processing purpose is lawful.

Under Article 28, processors must provide sufficient guarantees and be governed by the required contract. Review instructions, confidentiality, security, subprocessors, assistance, deletion or return and audit provisions. Separately assess Chapter V requirements for transfers to third countries; a processing agreement alone does not authorise an international transfer.

A data protection impact assessment is required under Article 35 where processing is likely to result in high risk to individuals' rights and freedoms. It is not simply an enterprise cybersecurity risk assessment. Where high residual risk remains without mitigating measures, Article 36 requires prior consultation with the supervisory authority.

Dates and operational response times

The GDPR has applied since 25 May 2018. In November 2026, there is no new general grace period for existing processing. New activities should be assessed before deployment, and established activities reviewed when their purposes, technology or recipients change.

Under Article 12, respond to rights requests without undue delay and normally within one month of receipt. An extension of two further months is possible where necessary because of complexity and number of requests; inform the person within the initial month and explain the delay.

Article 33 requires controllers to notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless it is unlikely to create a risk to individuals' rights and freedoms. Explain delays. Processors notify the controller without undue delay.

Not every breach must be reported, but every personal data breach must be documented. Article 34 generally requires informing affected individuals without undue delay where high risk is likely, subject to its exceptions. Prepare these distinct decisions before an incident occurs.

Sanctions and other stakes

Article 83 provides two administrative fine tiers: up to €10 million or 2% of total worldwide annual turnover for an undertaking, and up to €20 million or 4%, depending on the infringement. In each tier, the higher amount applies. These are ceilings, not automatic penalties.

Authorities can also order changes, restrictions or bans on processing. Individuals may seek compensation under Article 82 where its conditions are met. Operational exposure includes suspended campaigns, delayed product launches and costly searches for data that should already have been deleted. Good records support decisions, but cannot cure unlawful processing by themselves.

A step-by-step compliance path

1. Assign ownership. Identify controllers, processors and business owners. Assess whether a data protection officer is required under Article 37 rather than appointing one solely because the organisation handles personal data. Define escalation routes for legal and security decisions.

2. Trace representative activities. Interview teams about actual collection, use, sharing and deletion. Include spreadsheets, support systems and suppliers. Capture purposes, people concerned, data categories, recipients and retention choices, then validate the account with operational owners.

3. Resolve lawfulness and transparency gaps. Check the legal basis against the activity. Review notices, retention and rights handling. Prioritise unnecessary collection and unexplained reuse instead of merely improving the formatting of existing documents.

4. Evaluate risk and suppliers. Screen activities for DPIA requirements. Assess security safeguards and processor contracts. Review international transfers separately. Give each gap an owner, a correction plan and a decision point before a high-risk launch proceeds.

5. Exercise requests and breaches. Run a sample access request through all relevant systems. Simulate a misdirected export or compromised account. Record assessment, timestamps, approvals and the reasoning behind notification or non-notification.

6. Make review event-driven. Revisit assessments when vendors, purposes, retention rules or access patterns change. Check that deletion and access controls work in practice. Retain evidence of reviews and close actions only after confirming the intended result.

How Domyno helps teams coordinate

Domyno combines SaaS with a dedicated human expert. Agents prepare work and a human validates it. This provides support for structured preparation without turning the platform into a substitute for legal accountability or specialist privacy judgment.

Asset management helps organise the systems supporting your activities. Third-party management supports supplier work, while controls and compliance brings evidence, action plans and one control library across more than 28 frameworks. Shared security measures can serve several obligations without confusing their legal scope.

Documentation includes policies and versions. More than 300 connectors, including on-premises Active Directory, support the platform's integration options. Hosting can be in any cloud, any region or on premises; the selected arrangement still needs its own privacy and transfer assessment.

Official reference

Validate your legal decisions against the GDPR text on EUR-Lex.

To discuss how privacy and security teams can coordinate their evidence and action plans, request a Domyno demo.