GDPR briefs.

You have EU users, EU employees, or you’re a US SaaS company selling into European markets. GDPR (General Data Protection Regulation) applies regardless of where your company is incorporated — if you process the personal data of EU residents, you’re in scope. There is no revenue threshold and no headcount minimum.

The regulation covers lawful basis for processing (consent, legitimate interest, contract, and three others), data subject rights (access, erasure, portability, objection), Article 28 processor contracts with every vendor who touches personal data, breach notification within 72 hours, and — for some organisations — a mandatory Data Protection Officer. Standard Contractual Clauses (SCCs) are required for transfers of EU personal data to the US and other third countries.

The briefs below cover what this means operationally: data mapping, privacy notices, DSAR workflows, and how GDPR overlaps with CCPA and HIPAA for companies under multiple privacy laws. If you’re ready to start your GDPR programme, visit the GDPR service page.