Background
What is the GDPR and Who Does It Affect?
The General Data Protection Regulation (GDPR) (EU Regulation 2016/679) is the central European data protection regulation. It has been directly applicable since May 25, 2018 and affects virtually every company that processes personal data of EU residents.
The GDPR is based on 7 principles (Article 5): lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability. Every processing of personal data must be based on one of the 6 legal bases of Article 6: consent, contract, legal obligation, vital interests, public interest, or legitimate interest.
What makes the GDPR unique is its extraterritorial scope (market location principle): even companies outside the EU must comply if they offer goods or services to EU residents or monitor their behavior. Violations can result in fines of up to EUR 20 million or 4% of annual global turnover.
Key areas include data subject rights (Art. 15-22), records of processing activities (Art. 30), data processing agreements (Art. 28), the Data Protection Officer (Art. 37-39), and breach notification within 72 hours (Art. 33).
The 7 Principles of Data Processing (Art. 5)
Core principles of the GDPR
- Lawfulness, fairness, and transparency
- Purpose limitation: data only for specified purposes
- Data minimization: collect only what is necessary
- Accuracy: keep data up to date
- Storage limitation: not longer than necessary
- Integrity and confidentiality (security)
- Accountability: demonstrate compliance
Who Does the GDPR Affect?
Market location principle: regardless of company location
- Any company processing personal data of EU residents
- Controllers: determine purpose and means of processing
- Processors: process data on behalf of controllers
- Also companies outside the EU targeting EU residents
Free GDPR Readiness Check
How Well Are You Positioned?
Find out in 2 minutes. Free and anonymous.
GDPR Readiness Check
Answer 5 short questions and find out how well your company is positioned for GDPR compliance.
Note: This initial assessment is based on your responses and publicly available criteria (NIS2). It is not legally binding and does not replace an individual case review.
Timeline
The Path to GDPR Compliance
Assessment
Record all processing activities, check legal bases, document data flows.
Records of Processing
Create complete records per Art. 30: purpose, legal basis, recipients, deletion periods.
TOMs & Policies
Document technical and organizational measures, create privacy policies.
Establish Processes
Implement DSAR process, breach notification, DPA management, and training.
Audit Readiness
Collect evidence, document accountability, prepare for supervisory authority review.
Assessment
Record all processing activities, check legal bases, document data flows.
Records of Processing
Create complete records per Art. 30: purpose, legal basis, recipients, deletion periods.
TOMs & Policies
Document technical and organizational measures, create privacy policies.
Establish Processes
Implement DSAR process, breach notification, DPA management, and training.
Audit Readiness
Collect evidence, document accountability, prepare for supervisory authority review.
The sooner you start, the sooner you’re compliant. Kopexa supports you at every step.
GDPR Obligations
Key Obligations at a Glance
6 core areas that every company must implement.
Records of Processing (Art. 30)
Documentation of all processing activities with purpose, legal basis, and deletion periods.
Technical & Org. Measures (Art. 32)
Encryption, access controls, backup strategies, and regular security reviews.
Data Subject Rights (Art. 15–22)
Access, erasure, rectification, data portability, and objection, implemented within deadlines.
Data Processing (Art. 28)
Conclude DPAs with every service provider, document and control sub-processors.
Data Protection Officer (Art. 37–39)
Appoint DPO, define duties, ensure independence and protection against dismissal.
Breach Notification (Art. 33–34)
Report data breaches within 72 hours and notify data subjects when there is a high risk.
How Kopexa Helps
From Requirement to Implementation
Manage data subject requests?
DSAR Management in Kopexa
Data subjects have extensive rights: access, erasure, rectification, data portability. Kopexa helps you process DSAR requests within deadlines and document everything.
- DSAR tracking and deadline management
- Response letter templates
- Audit trail for evidence
Create records of processing?
Document processing activities centrally
Art. 30 GDPR requires a complete record of all processing activities. Kopexa makes this simple: record activities, assign legal bases, track deletion periods.
- Structured records of processing
- Legal basis assignment
- Deletion period management
Manage processors?
Vendor management with DPA tracking
Art. 28 GDPR requires agreements with every service provider. Kopexa manages processors, tracks DPA status, and documents service provider TOMs.
- Processor register
- DPA status and deadlines
- TOM documentation per provider
All Frameworks. One System.
Built by GRC Experts for European Mid-Market Companies
Kopexa is built on OSCAL, the open NIST standard for machine-readable compliance frameworks. Every framework, every standard, every regulation: available instantly or custom-built with our Framework Builder.
Content Hub
Deep Dive into GDPR
Requirements
All GDPR requirements at a glance
Data Subject Rights
Rights of data subjects under Art. 15–22
Data Processing
Obligations for data processing (Art. 28)
Data Protection Officer
Requirement, duties, and position of the DPO
Technical Measures
Technical and organizational measures (Art. 32)
Records of Processing
Records of processing activities (Art. 30)
DPIA
Data Protection Impact Assessment (Art. 35)
Breach Notification
Breach notification obligations (Art. 33–34)
Fines & Penalties
GDPR fines and enforcement (Art. 83–84)
International Transfers
Third-country transfers, SCCs, and adequacy (Art. 44–49)
GDPR Checklist
10 steps to GDPR compliance
ISO 27001 Mapping
Cross-mapping and dual compliance
Frequently Asked Questions about the GDPR
What is the GDPR?
The GDPR (General Data Protection Regulation, EU Regulation 2016/679) is the central European data protection regulation that has been directly applicable in all EU member states since May 25, 2018. It regulates the protection of personal data and grants data subjects extensive rights such as access, erasure, and data portability.
Who does the GDPR apply to?
The GDPR applies to all companies and organizations that process personal data of EU residents, regardless of whether they are based in the EU or not (market location principle). In practice, the GDPR affects virtually every company operating in the EU.
What is personal data?
Personal data is any information relating to an identified or identifiable natural person. This includes name, email address, IP address, location data, cookies, health data, biometric data, and much more. The definition is intentionally broad.
What is a Record of Processing Activities?
The Record of Processing Activities (Art. 30 GDPR) documents all processes in which personal data is processed. It must contain the purpose, legal basis, categories of data subjects and data, recipients, deletion periods, and technical protection measures. It is mandatory for every controller and processor.
When do I need a Data Protection Officer?
Under German law (§ 38 BDSG), a Data Protection Officer (DPO) is mandatory when at least 20 persons are regularly engaged in automated processing of personal data. Regardless of staff size, a DPO is also required when extensive processing of special categories of data (Art. 9 GDPR) or systematic monitoring takes place.
What is a Data Protection Impact Assessment?
A Data Protection Impact Assessment (DPIA, Art. 35 GDPR) is a risk analysis that must be conducted when processing is likely to result in a high risk to the rights and freedoms of natural persons. Typical cases: video surveillance, scoring, profiling, large-scale processing of special categories of data.
What rights do data subjects have?
Data subjects have extensive rights under Art. 15–22 GDPR: right of access (Art. 15), right to rectification (Art. 16), right to erasure/right to be forgotten (Art. 17), right to restriction (Art. 18), right to data portability (Art. 20), right to object (Art. 21), and right against automated decision-making (Art. 22). The response deadline is one month.
What happens in a data breach?
In case of a personal data breach, the controller must notify the competent supervisory authority within 72 hours (Art. 33 GDPR). Data subjects must be notified when there is a high risk to their rights (Art. 34). All data breaches must be documented.
How high are GDPR fines?
The GDPR provides two fine tiers: up to EUR 10M or 2% of global annual turnover for violations of organizational obligations, and up to EUR 20M or 4% of annual turnover for serious violations such as breach of data subject rights or unlawful data processing. Prominent cases: Meta (EUR 1.2B), Amazon (EUR 746M).
How does Kopexa help with GDPR compliance?
Kopexa offers a preloaded GDPR framework with all requirements, a measures catalog with best-practice TOMs, templates for records of processing and DPAs, integrated vendor management for processors, cross-mapping to ISO 27001 and NIS2, and centralized evidence collection for audit readiness. The gap analysis immediately shows where action is needed.
Let’s Assess Where You Stand
Free & non-binding. Response within 24h.