If the people whose data you touch are in the EU or the UK, GDPR reaches you — wherever you are incorporated. This page is what it actually asks for, and what the proof looks like.
Most GDPR pages open by telling you it applies to everyone. It does not. Tick what is true, and we will name the articles each answer pulls in.
This is a scoping aid, not legal advice. It tells you which articles your situation engages — it cannot tell you whether you satisfy them, and under this Regulation several of the tests are genuinely arguable.
Not a consent banner and a policy page. A demonstrable programme — and the burden of demonstrating it is on you.
Regulation (EU) 2016/679 has applied since 25 May 2018. It governs the processing of personal data — anything relating to an identified or identifiable person — and Article 3(2) reaches organisations outside the EU where they offer goods or services to, or monitor the behaviour of, people in the Union. The UK runs a near-identical regime with its own fine caps and its own supervisory authority.
Six principles — lawfulness, purpose limitation, data minimisation, accuracy, storage limitation and security — plus accountability, which is the one that turns the other six into documents. Every purpose needs a lawful basis under Article 6, and special category data needs a further condition under Article 9.
A record of processing under Article 30. A DPIA where processing is likely to be high risk. 72 hours to notify a personal data breach. A lawful transfer mechanism for anything leaving the EEA. And eight rights your processes have to be able to honour on request.
Purpose limitation and Article 22. Data collected to deliver a service cannot simply be reused to train a model. And a solely automated decision with legal or similarly significant effects is prohibited unless one of three narrow gateways applies.
Where the person is, not where you are. Establishment in the EU is not required for the Regulation to apply.
Of global annual turnover, whichever is higher — the Article 83(5) tier, for principles, rights and transfers.
You decide why and how personal data is processed. Almost every duty on this page lands on you first, whoever actually runs the systems.
You process on a controller’s instructions. Article 28 binds you by contract, and Articles 30, 32, 33 and Chapter V bind you directly — not through your customer.
Employee data is personal data, consent is rarely a valid basis in an employment relationship, and monitoring almost always needs a DPIA.
Solely automated decisions with legal or similarly significant effects engage Article 22: a lawful gateway, meaningful information about the logic, and a route to human intervention.
Your customers cannot answer their own Article 30, Article 28 or transfer questions without your documentation. Increasingly it is procurement, not a regulator, that asks first.
Article 3(2) reaches you if you offer goods or services to, or monitor the behaviour of, people in the EU. Your place of establishment is not the test.
Twelve obligations with their articles, and the artefact that discharges each one. Paired, so every claim on this page can be checked against the duty beside it.
The six workstreams the engagement is organised around. Each one is a change in how the organisation operates, not a document that lands and then ages.
Data mapped from the system inwards rather than the questionnaire outwards, so the Article 30 record matches what your estate actually does.
A screening test, a methodology and completed DPIAs — including the residual-risk call and, where it stands, the consultation question.
One intake route, identity verification, a search that reaches the backups and the ticketing system, and a decision record per request.
The 72-hour clock starts at awareness, not at confirmation. We set the trigger, the decision tree and the notification pack before you need them.
Where consent is the basis, it has to be recorded, granular and as easy to withdraw as to give. Where it is not the basis, we say what is.
Article 28 terms, sub-processor chains and the Chapter V mechanism per route — with the transfer impact assessment where the mechanism needs one.
Six in Article 5(1). Accountability in Article 5(2). Data protection by design is Article 25 — an obligation, not a principle. We keep it here because every working programme treats it as one, and we label it honestly.
A lawful basis for every purpose, processing that a person would not find unfair or surprising, and information that is actually reachable.
Collected for a specified purpose and not reused for something incompatible with it. This is the principle secondary AI training most often breaks.
Adequate, relevant and limited to what is necessary. Necessary for the purpose — not for a purpose you might find later.
Kept accurate and, where necessary, up to date — with inaccurate data erased or rectified without delay.
Kept in identifiable form no longer than necessary. A retention schedule nobody executes is not storage limitation.
Appropriate security against unauthorised processing, loss and damage — argued against the risk, under Article 32.
You must be able to demonstrate compliance, not merely achieve it. This is the principle that turns everything above into documents.
Not an Article 5 principle — an obligation in its own right, and the one that decides whether the other seven are cheap or expensive.
The eighth is not an Article 5 principle. Data protection by design and by default is Article 25 — an obligation in its own right. It is here because every working programme treats it as a principle, and because it is the one that decides whether the other seven are cheap or expensive. Citing it as Article 5 would be convenient and wrong, so the card carries its real article.
What a person can ask you for, and what your processes have to be able to do about it inside a month. Most of these fail on search coverage, not on willingness.
What you do with the data, told at collection or within a month if you got it elsewhere.
A copy of the personal data, plus the supplementary information about how and why it is processed.
Inaccurate data corrected, incomplete data completed — and recipients told, where feasible.
Deletion where one of the six grounds applies — not an unconditional right, and the exemptions are real.
Processing paused while accuracy or a legitimate-interests objection is being worked out.
Data the person provided, on consent or contract and processed by automated means, in a structured machine-readable format.
Absolute for direct marketing. For legitimate interests, you must stop unless you can show compelling grounds.
Not to be subject to a solely automated decision with legal or similarly significant effects, save on three narrow gateways.
Withdrawal of consent is not on this list, and that is deliberate. Article 7(3) makes consent as easy to withdraw as to give, but it is a condition of consent rather than one of the Chapter III rights — so it sits inside the lawfulness principle above. If you rely on consent, withdrawal still has to work, and it still has to stop the processing.
A practical path to GDPR compliance with clear milestones. Phase one is the one people skip, and it is the one everything else is built on.
Find out what you actually process
Write the things you will be asked for
Make the paper true
Prove it, then keep proving it
Twenty-six weeks is elapsed time for a mid-sized estate, not effort. The phases overlap in practice — documentation starts before mapping finishes, and monitoring starts before the technical work is done. Read as four consecutive sprints the ranges add to more than the total, which is the one way to misread this plate.
Two tiers, both statutory, each one “whichever is higher”. They have not moved since 2018 — and they are not the interesting number. The interesting number is what a supervisory authority asks for first, which is the Article 30 record.
Obligations of controllers and processors
Principles, rights and transfers
Deliberately no league table of past fines here: the total moves every month and the register is public. For current enforcement, see the European Data Protection Board. UK GDPR runs the same two tiers at £8.7 million or 2 per cent and £17.5 million or 4 per cent.
31 ready-to-use templates aligned to the Regulation and to ISO/IEC 27001, tailored to your estate rather than handed over as a generic pack.
+ 5 more in this group
+ 4 more in this group
+ 4 more in this group
Scope, deadlines, transfers and the questions AI teams keep arriving with. Filter to the one you came for.
If you offer goods or services to people in the EU, or monitor their behaviour, Article 3(2) reaches you regardless of where you are established. Payment in money is not required, and an English-language site alone is not enough — the test is whether you envisage offering to people in the Union.
A controller decides the purposes and means of processing; a processor acts on the controller’s documented instructions. The label follows the facts, not the contract: a vendor that decides what to do with the data for its own ends is a controller for that processing, whatever the agreement calls it.
Article 37 requires one if you are a public authority, if your core activities require regular and systematic monitoring of people on a large scale, or if your core activities involve large-scale processing of special category or criminal-offence data. If none applies, you may still appoint one — but record the decision either way, because the assessment is part of accountability.
The obligations are substantially the same. The differences that matter operationally are the fine caps — £8.7 million or 2 per cent, and £17.5 million or 4 per cent — the supervisory authority, and the fact that a transfer between the UK and the EU is its own question with its own mechanism.
One month from receipt. That can be extended by up to two further months where the request is complex or numerous, but you must tell the person within the first month, with the reason. The clock does not pause while you decide whether the request is valid.
Under Article 35, whenever processing is likely to result in a high risk to people’s rights and freedoms — in particular systematic and extensive automated evaluation with legal or similarly significant effects, large-scale special category processing, or large-scale systematic monitoring of a publicly accessible area. Your supervisory authority also publishes its own list.
From when you become aware of the breach, not from when the investigation finishes. If you cannot supply everything in time you may notify in phases, but the initial notification still has to go in. Whether individuals must be told is a separate, higher test: a high risk to their rights and freedoms.
Article 30 exempts organisations under 250 employees — but not where the processing is other than occasional, is likely to risk rights and freedoms, or involves special category or criminal-offence data. In practice that exemption almost never survives contact with a real estate, and the record is the first thing a supervisory authority asks for.
Only with a lawful basis for that purpose and a compatibility assessment if the data was collected for something else. Purpose limitation is the principle secondary training most often breaks, and “the data was already in our warehouse” is not a basis.
If a decision is solely automated and has legal or similarly significant effects, it is prohibited unless it is necessary for a contract, authorised by law, or based on explicit consent. Where a gateway applies you still owe meaningful information about the logic, and a genuine route to human intervention — a reviewer who can only confirm the output does not satisfy it.
SCCs are the European Commission’s approved contract terms for transferring personal data outside the EEA where no adequacy decision covers the destination. Following Schrems II you also need a transfer impact assessment of the destination’s law and practice, plus supplementary measures where the assessment finds the clauses alone are not enough.
Usually the opposite. Consent must be freely given, specific, informed, unambiguous and as easy to withdraw as to give — and withdrawal stops the processing. Where there is an imbalance of power, as with employees, it is rarely valid at all. Contract or legitimate interests is often both more honest and more durable.
They stack rather than substitute. Where an AI system processes personal data you owe both, and the overlap is large: the DPIA and the AI Act’s assessment ask related questions, and Article 22 and the AI Act’s human-oversight duties land on the same control. One review scoped across both is cheaper than two that disagree.
It is scoped before you are charged. The variables are the number of systems in the estate, how much of the Article 30 record already exists, and whether transfers and automated decisions are in play; we tell you the shape of all three after a short scoping call.
This page is a working summary. Where a decision turns on the wording, the Regulation is short enough to read and the guidance is free.
The text, the Board and the UK regulator. External links.
The regimes that most often sit alongside GDPR in the same scope.
Start with a guided assessment: the processing inventory, the lawful basis register, the gap list against every article on this page, and a sequenced plan — scoped before you are charged.
This page is guidance on how we scope a GDPR readiness review, not legal advice. Where a question is genuinely arguable — and under this Regulation many are — we say so in writing rather than pick the convenient answer.
From Insights
Six things to have ready before the engagement starts. Assembling them takes a fortnight off the clock — and tends to find the first two findings before an auditor does.
Read the notesAn independent review of what your AI actually does, measured against a named standard — not a certificate, and not a review of what the documentation says it does.
Read the notesFive working parts, not a policy document. What each one has to do, how to tell whether yours is real, and why a framework is not the same thing as compliance.
Read the guide
