Does the GDPR apply to a company outside the EU?

Yes, in two situations under Article 3(2). Where you offer goods or services to individuals in the EU, whether or not payment is required, and where you monitor their behaviour within the EU, which includes most analytics and advertising tracking. Establishment in the EU is not required. Most organisations caught this way must also appoint a written representative in the EU under Article 27.

What are the six lawful bases under the GDPR?

Consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a task in the public interest or official authority, and legitimate interests. Legitimate interests requires a documented three-part balancing test and is not available to public authorities acting in the performance of their tasks.

How long do I have to answer a data subject access request?

One month from receipt of the request. That may be extended by a further two months where the request is complex or numerous, but you must tell the individual about the extension and the reason for it within the first month. The response is free of charge unless the request is manifestly unfounded or excessive.

When must a personal data breach be reported under the GDPR?

To the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. Affected individuals must also be told without undue delay where the breach is likely to result in a high risk to them. Every breach must be documented internally regardless of whether it is reported.

When is a Data Protection Officer mandatory?

In three cases under Article 37. Where processing is carried out by a public authority or body, where core activities involve regular and systematic monitoring of individuals on a large scale, or where core activities involve large-scale processing of special category data or criminal conviction data. Some member states, notably Germany, impose additional national thresholds.

How can personal data be transferred outside the EEA?

Through an adequacy decision, an appropriate safeguard such as the 2021 Standard Contractual Clauses or Binding Corporate Rules, or in limited cases a derogation under Article 49. Since Schrems II, use of SCCs must be supported by a transfer impact assessment examining the law and practice of the destination country, with supplementary measures where necessary. Certified US importers can also receive data under the EU-US Data Privacy Framework.

What is the maximum GDPR fine?

There are two tiers. The lower tier is up to 10 million euro or 2 percent of total worldwide annual turnover of the preceding financial year, whichever is higher. The upper tier is up to 20 million euro or 4 percent, whichever is higher, and applies to breaches of the principles, lawful basis, data subject rights and the transfer rules.

Do cookie banners fall under the GDPR?

Storing or accessing information on a user's device is governed by the ePrivacy Directive, which requires consent for anything that is not strictly necessary. The GDPR then supplies the standard that consent must meet: freely given, specific, informed and unambiguous, as easy to withdraw as to give. In practice this means no pre-ticked boxes, no cookie walls in most cases, and a reject option as prominent as accept.

European Union · Regulation (EU) 2016/679

The GDPR, translated into things your team can actually do.

A practical guide to scope, principles, lawful bases, rights, DPIAs, records, transfers, cookies, breach response and enforcement.

Reviewed against the Regulation and current EDPB guidance on 11 September 2026. Written by Shambhu Kumar, Vedhacon.

Get a GDPR gap assessment Check your readiness

Articles 2, 3 and 4

Who it applies to, and in which role

EU establishment

Processing in the context of an EU establishment is covered wherever processing occurs.

Targeting test

Non-EU organisations are covered when offering goods or services to, or monitoring, people in the EU.

Controller and processor

The controller decides purposes and means; a processor acts on documented instructions.

Article 27 representative

Non-EU organisations caught by Article 3(2) usually need a written EU representative.

Personal data

Includes online identifiers, device IDs, location traces and pseudonymised records.

Accountability

Article 5(2) requires compliance to be demonstrated through records and evidence.

Article 5

The seven principles

Lawfulness, fairness and transparencyArt 5(1)(a)

Apply this principle to every processing purpose and keep evidence of the decision.

Purpose limitationArt 5(1)(b)

Apply this principle to every processing purpose and keep evidence of the decision.

Data minimisationArt 5(1)(c)

Apply this principle to every processing purpose and keep evidence of the decision.

AccuracyArt 5(1)(d)

Apply this principle to every processing purpose and keep evidence of the decision.

Storage limitationArt 5(1)(e)

Apply this principle to every processing purpose and keep evidence of the decision.

Integrity and confidentialityArt 5(1)(f)

Apply this principle to every processing purpose and keep evidence of the decision.

AccountabilityArt 5(2)

Apply this principle to every processing purpose and keep evidence of the decision.

Article 6

The six lawful bases

ConsentArt 6(1)(a)

Freely given, specific, informed, unambiguous and withdrawable.

ContractArt 6(1)(b)

Objectively necessary to perform or enter a contract with the individual.

Legal obligationArt 6(1)(c)

Necessary under Union or member-state law.

Vital interestsArt 6(1)(d)

Necessary to protect life in a genuine emergency.

Public taskArt 6(1)(e)

Necessary for a legally grounded public-interest or official-authority task.

Legitimate interestsArt 6(1)(f)

Requires purpose, necessity and balancing tests documented in advance.

Do not default to consent. Choose and record the basis before processing begins.

Articles 9 and 10

Special category data needs a second key

What counts

An Article 9 condition is required in addition to an Article 6 lawful basis, with national-law checks where relevant.

Explicit consent

An Article 9 condition is required in addition to an Article 6 lawful basis, with national-law checks where relevant.

Employment and social security

An Article 9 condition is required in addition to an Article 6 lawful basis, with national-law checks where relevant.

Health and public interest

An Article 9 condition is required in addition to an Article 6 lawful basis, with national-law checks where relevant.

Legal claims

An Article 9 condition is required in addition to an Article 6 lawful basis, with national-law checks where relevant.

Manifestly made public

An Article 9 condition is required in addition to an Article 6 lawful basis, with national-law checks where relevant.

Research and archiving

An Article 9 condition is required in addition to an Article 6 lawful basis, with national-law checks where relevant.

Criminal data, Article 10

An Article 9 condition is required in addition to an Article 6 lawful basis, with national-law checks where relevant.

Articles 12–22

All eight rights, and the clock on each

1. To be informedArt 13–14

Respond without undue delay and normally within one month; document identity checks, searches, decisions and communications.

2. AccessArt 15

Respond without undue delay and normally within one month; document identity checks, searches, decisions and communications.

3. RectificationArt 16

Respond without undue delay and normally within one month; document identity checks, searches, decisions and communications.

4. ErasureArt 17

Respond without undue delay and normally within one month; document identity checks, searches, decisions and communications.

5. RestrictionArt 18

Respond without undue delay and normally within one month; document identity checks, searches, decisions and communications.

6. Data portabilityArt 20

Respond without undue delay and normally within one month; document identity checks, searches, decisions and communications.

7. ObjectArt 21

Respond without undue delay and normally within one month; document identity checks, searches, decisions and communications.

8. Automated decisionsArt 22

Respond without undue delay and normally within one month; document identity checks, searches, decisions and communications.

Chapter IV

What a compliant programme contains

Records of processing

Maintain an accountable, risk-based process and evidence that it operates in practice.

Data protection by design and default

Maintain an accountable, risk-based process and evidence that it operates in practice.

DPIAs

Maintain an accountable, risk-based process and evidence that it operates in practice.

Security of processing

Maintain an accountable, risk-based process and evidence that it operates in practice.

Breach notification

Maintain an accountable, risk-based process and evidence that it operates in practice.

Processor contracts

Maintain an accountable, risk-based process and evidence that it operates in practice.

Articles 37–39

When you need a Data Protection Officer

Public bodies

Mandatory except for courts acting judicially.

Large-scale monitoring

Mandatory where core activities require regular and systematic monitoring at scale.

Large-scale sensitive data

Mandatory for core activities involving special-category or criminal data at scale.

Article 28

Every processor contract needs these terms

Article 28 processor contract requirements
Required term	Requirement
Documented instructions	Include the corresponding Article 28(3) obligation expressly and verify it operationally.
Confidentiality	Include the corresponding Article 28(3) obligation expressly and verify it operationally.
Security	Include the corresponding Article 28(3) obligation expressly and verify it operationally.
Sub-processors	Include the corresponding Article 28(3) obligation expressly and verify it operationally.
Assistance with rights	Include the corresponding Article 28(3) obligation expressly and verify it operationally.
Assistance with duties	Include the corresponding Article 28(3) obligation expressly and verify it operationally.
Deletion or return	Include the corresponding Article 28(3) obligation expressly and verify it operationally.
Audit and information	Include the corresponding Article 28(3) obligation expressly and verify it operationally.

Articles 35 and 36

DPIA, assessing risk before you process

1. Screen
Record the analysis, evidence, owner and outcome.
2. Describe
Record the analysis, evidence, owner and outcome.
3. Test necessity
Record the analysis, evidence, owner and outcome.
4. Consult
Record the analysis, evidence, owner and outcome.
5. Assess risk
Record the analysis, evidence, owner and outcome.
6. Mitigate
Record the analysis, evidence, owner and outcome.
7. Sign off
Record the analysis, evidence, owner and outcome.
8. Review
Record the analysis, evidence, owner and outcome.

Article 30

RoPA, records of processing activities

Article 30 records of processing fields
Field	What it records
Identity and contacts	Maintain this field for each processing activity and review it when systems, vendors or purposes change.
Purposes	Maintain this field for each processing activity and review it when systems, vendors or purposes change.
Categories	Maintain this field for each processing activity and review it when systems, vendors or purposes change.
Recipients	Maintain this field for each processing activity and review it when systems, vendors or purposes change.
Transfers	Maintain this field for each processing activity and review it when systems, vendors or purposes change.
Retention	Maintain this field for each processing activity and review it when systems, vendors or purposes change.
Security measures	Maintain this field for each processing activity and review it when systems, vendors or purposes change.
Owner	Maintain this field for each processing activity and review it when systems, vendors or purposes change.

Articles 44–50

Sending data outside the EEA

Adequacy decisions

Map the transfer, select a valid mechanism, assess destination-country risks and record supplementary measures.

2021 Standard Contractual Clauses

Map the transfer, select a valid mechanism, assess destination-country risks and record supplementary measures.

Transfer impact assessment

Map the transfer, select a valid mechanism, assess destination-country risks and record supplementary measures.

EU-US Data Privacy Framework

Map the transfer, select a valid mechanism, assess destination-country risks and record supplementary measures.

Binding Corporate Rules

Map the transfer, select a valid mechanism, assess destination-country risks and record supplementary measures.

Article 49 derogations

Map the transfer, select a valid mechanism, assess destination-country risks and record supplementary measures.

ePrivacy Directive

Cookies, trackers and the banner problem

Two laws working together

ePrivacy governs storage or access on a device; GDPR defines valid consent.

A compliant banner

Blocks non-essential tracking, presents reject as prominently as accept, avoids pre-ticked boxes and provides easy withdrawal.

Articles 33 and 34

The 72-hour clock

Notify the authority

Within 72 hours where risk is likely, with staged notification if needed.

Tell individuals

Without undue delay where high risk is likely.

Keep a register

Document every breach, effects, decision and remediation, reported or not.

Articles 51–59

Find your supervisory authority

AustriaDSB

BelgiumAPD / GBA

BulgariaCPDP

CroatiaAZOP

CyprusCommissioner

CzechiaÚOOÚ

DenmarkDatatilsynet

EstoniaAKI

FinlandOmbudsman

FranceCNIL

GermanyBfDI + state authorities

GreeceHellenic DPA

HungaryNAIH

IrelandDPC

ItalyGarante

LatviaDVI

LithuaniaVDAI

LuxembourgCNPD

MaltaIDPC

NetherlandsAP

PolandUODO

PortugalCNPD

RomaniaANSPDCP

SlovakiaOffice for PDP

SloveniaInformation Commissioner

SpainAEPD

SwedenIMY

NorwayDatatilsynet

IcelandPersónuvernd

LiechtensteinDatenschutzstelle

No match.

Article 83

Two penalty tiers

€10m or 2%

Lower tier

€20m or 4%

Upper tier

€1.2bn · Meta transfers

Illustrative enforcement outcome referenced in this guide.

€746m · Amazon advertising

Illustrative enforcement outcome referenced in this guide.

€345m · TikTok children

Illustrative enforcement outcome referenced in this guide.

€150m · Google cookies

Illustrative enforcement outcome referenced in this guide.

Article 4