GDPR Guides

GDPR (General Data Protection Regulation) is the EU's comprehensive data protection law effective since May 25, 2018. It governs how organizations process personal data of EU residents, regardless of where the company is located. Maximum fines are EUR 20 million or 4% of global annual revenue.

Yes, if you collect data from EU residents (even through a website), GDPR applies regardless of your company location. GDPR has extraterritorial scope, meaning it's based on whose data you process, not where your company is headquartered.

Personal data is any information that can identify a living individual, directly or indirectly. This includes names, email addresses, IP addresses, cookie IDs, location data, financial data, behavioral data, and biometric data. Even pseudonymized data qualifies if it can be traced back to an individual.

A Data Controller determines why and how data is processed (that's you if you collect customer data). A Data Processor processes data on behalf of a controller (like your CRM provider). Controllers are responsible for compliance; processors must follow controller instructions and have a Data Processing Agreement.

GDPR grants 8 rights: Right to be Informed, Right of Access (DSAR), Right to Rectification, Right to Erasure ('right to be forgotten'), Right to Restrict Processing, Right to Data Portability, Right to Object, and Rights Related to Automated Decision-Making.

You must respond within one month for standard requests (Article 12). Complex requests can be extended by two additional months (up to three months total), but you must notify the requester within the first month. The first request must be free; you can charge for excessive or repetitive requests.

No, consent is one of six legal bases for processing data. Others include contractual necessity, legal obligation, vital interests, public task, and legitimate interests. Legitimate interests or contractual necessity may be more appropriate than consent for many B2B uses.

Maximum penalties are EUR 20 million or 4% of global annual revenue, whichever is higher. Beyond fines, GDPR non-compliance affects customer trust, investor expectations, and enterprise sales opportunities.

A DPO is required under Article 37 for public authorities, organizations whose core activities involve large-scale regular monitoring of individuals, or those whose core activities involve large-scale processing of special categories of data. Most B2B SaaS companies don't legally require a DPO but may appoint one voluntarily.

A DPA is a legally binding contract between a data controller and processor. It defines data processing purposes, security measures, subprocessor rules, and audit rights. GDPR Article 28 requires DPAs whenever you share personal data with processors.