Make GDPR compliance continuous, evidenced and audit-ready

GDPR is the General Data Protection Regulation, Regulation (EU) 2016/679, the European Union's main data protection law. It has applied since 25 May 2018 and governs how organisations process personal data. It sets seven principles, requires a lawful basis for processing, gives individuals rights such as access and erasure, and imposes security, breach notification and accountability duties on controllers and processors.

Any organisation that processes personal data and is established in the EU must comply with GDPR, whether it acts as a controller or a processor. Organisations outside the EU must also comply when they offer goods or services to people in the EU or monitor their behaviour there. Size is not an exemption, although some record-keeping duties are lighter for organisations with fewer than 250 employees.

The most serious GDPR infringements can lead to administrative fines of up to EUR 20 million or 4% of total worldwide annual turnover for the preceding financial year, whichever is higher. Other infringements carry fines of up to EUR 10 million or 2%. Supervisory authorities can also order processing to stop, and individuals can claim compensation for material or non-material damage.

Under Article 33, a controller must notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals. If the breach is likely to result in a high risk, Article 34 also requires informing the affected individuals without undue delay.

There is no mandatory GDPR certificate. Compliance is shown through accountability: records of processing, policies, impact assessments, contracts and evidence that security measures work. Article 42 allows approved certification schemes, but they are voluntary and do not by themselves prove compliance. Many organisations pair GDPR with ISO 27001 or SOC 2 to give customers independent assurance over security.

GDPR is a legal requirement, while ISO 27001 is a voluntary, certifiable security standard. ISO 27001 controls help meet GDPR's security duty in Article 32 but do not cover lawful basis, transparency or individuals' rights. The UK GDPR is the retained UK version that applies to processing in the UK, so UK firms serving EU customers often need to meet both.

To comply with GDPR, map the personal data you hold and why, record a lawful basis for each processing activity, publish clear privacy notices and set up processes for individuals' rights requests. Then put appropriate security measures in place, sign compliant contracts with processors, carry out impact assessments for high-risk processing, prepare a breach response plan and keep evidence that all of this works.

Yes. OneClickComply supports GDPR today. It maps your controls to GDPR articles, collects evidence automatically from connected tools, generates policies from your real environment and monitors controls continuously. Evidence collected for GDPR also counts towards ISO 27001, SOC 2 and other frameworks you follow. OneClickComply does not certify GDPR compliance, but our in-house auditors can advise on gaps through Ask an Auditor.