- GDPR applies to any organisation processing EU residents' data, regardless of where that organisation is based
- Every processing activity must have a documented lawful basis before it starts, not after a complaint arrives
- You have 72 hours to notify your supervisory authority after discovering a breach that poses a risk to individuals
- Data subject rights requests must be responded to within one month, at no cost to the individual
- Tier 2 fines can reach €20 million or 4% of global annual turnover, whichever is higher
Who GDPR applies to
GDPR's extraterritorial scope is the part most organisations underestimate. Article 3 makes the regulation apply to any organisation that processes the personal data of individuals in the EU or EEA, regardless of where the organisation is established. A company based in New York selling software subscriptions to Dutch businesses, or a Brazilian firm monitoring the browsing behaviour of French website visitors, is subject to GDPR. Location of your servers or your legal entity is not the determining factor. Processing EU residents' data is.
The regulation distinguishes between two roles. A data controller is any organisation that determines the purposes and means of processing personal data. A data processor acts on behalf of a controller. Both roles carry obligations under GDPR, but controllers bear primary responsibility. If you use a third-party tool to process customer data, you are the controller and that vendor is your processor: their compliance failures can become your regulatory exposure.
GDPR applies stricter rules to special category data: health and medical information, biometric data used for identification, genetic data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, and data concerning sexual orientation or sex life. Processing this data requires an additional condition from Article 9 on top of a standard lawful basis. Healthcare organisations, HR departments, and any platform collecting health-related information should review their Article 9 basis carefully.
The six lawful bases for processing
Every processing activity must rest on one of the six lawful bases in Article 6. Choosing the right one matters because it determines what rights apply and what you must communicate to individuals. Organisations frequently default to consent when a more appropriate basis would serve better and create fewer ongoing obligations.
Legitimate interests is the most flexible basis but also the most scrutinised. It requires a three-part test: identifying the legitimate interest, confirming the processing is necessary for that interest, and balancing it against the individual's rights. That balancing test should be documented, not just assumed.
Your four core obligations
Records of Processing Activities
Article 30 requires organisations to maintain a Record of Processing Activities (RoPA): a written inventory of every way you process personal data. Each entry should cover the purpose of processing, the categories of data and data subjects involved, any third parties you share data with, transfers to countries outside the EEA, and how long the data is retained.
Organisations with fewer than 250 employees are technically exempt from the full RoPA requirement unless their processing is not occasional, involves special category data, or presents a risk to individuals. In practice, most businesses processing customer data, employee data, or health information should maintain one. It is the foundation of every other compliance activity, and regulators request it at the start of almost every investigation.
Data Protection Impact Assessments
A Data Protection Impact Assessment (DPIA) is required before starting any processing that is likely to result in a high risk to individuals. Article 35 specifies that a DPIA is always required for large-scale processing of special category data, systematic and extensive profiling that significantly affects individuals, and large-scale monitoring of publicly accessible areas. Supervisory authorities also publish lists of processing types that require a DPIA in their jurisdiction.
A DPIA is not a one-time exercise. If you materially change a processing activity covered by an existing DPIA, the assessment should be reviewed and updated.
Breach notification
Article 33 requires you to notify your national supervisory authority within 72 hours of becoming aware of a personal data breach that is likely to result in a risk to individuals' rights and freedoms. If you cannot provide full details within 72 hours, you must notify with what you know and provide more information as it becomes available. The 72-hour clock starts when you become aware of the breach, not when it occurred.
Where the breach is likely to result in a high risk to individuals, Article 34 also requires you to notify the affected individuals directly, without undue delay. There is no minimum threshold for what counts as a breach: a misdirected email containing personal data is a breach and needs to be assessed against these notification requirements.
Data Protection Officer
A DPO is mandatory under Article 37 in three situations: you are a public authority or body; your core activities require large-scale, systematic monitoring of individuals; or your core activities involve large-scale processing of special category data. The DPO must be given the resources to perform their tasks independently and report directly to the highest level of management.
Even where a DPO is not legally required, appointing one or designating a senior data protection lead signals accountability to regulators and ensures someone owns the compliance programme. Supervisory authorities consistently note that the absence of any internal ownership of data protection is a significant aggravating factor in enforcement decisions.
Data subject rights
GDPR grants individuals eight rights over their personal data. You must be able to respond to any of these requests within one calendar month, free of charge. Extensions of up to two additional months are possible for complex or numerous requests, but you must notify the individual within the first month that you are extending.
The one-month response window for subject access requests catches many organisations off guard because the data they need to retrieve spans multiple systems: CRM, email, HR software, support tickets, and backups. Without a clear process and nominated owner, requests frequently go past the deadline. A late or incomplete response is independently reportable to the supervisory authority by the individual.
The fine structure
GDPR fines operate on two tiers, and the distinction matters because the top tier covers the most common compliance failures.
Tier 1 fines cover less serious infringements, primarily procedural and technical obligations: failing to maintain adequate records of processing, not implementing appropriate technical measures, failing to appoint a DPO when required. Tier 1 can reach €10 million or 2% of global annual turnover.
Tier 2 fines apply to the most serious infringements: violating core processing principles (lawfulness, fairness, transparency, purpose limitation, data minimisation), processing without a valid lawful basis, infringing data subject rights, and unlawful international transfers. Tier 2 fines can reach €20 million or 4% of global annual turnover, whichever is higher.
Fines are not the only enforcement tool available. Supervisory authorities can issue warnings, reprimands, temporary or permanent bans on processing, and orders to notify affected individuals. The Dutch Autoriteit Persoonsgegevens has been increasingly active: its published enforcement decisions cover everything from inadequate cookie consent to insufficient breach notification at large employers.
Getting your programme in order
If your data protection programme has not been reviewed recently, start with the RoPA. A current, accurate processing register makes every other compliance activity easier: lawful basis reviews, DPIAs, privacy notice updates, and breach response all depend on knowing what you process and why.
- Audit your current processing activities and document each one in your RoPA, including the lawful basis for each activity.
- Review your privacy notices to ensure they match what you actually do, not what you intended to do when they were last written.
- Build a breach response procedure that includes the 72-hour notification step explicitly, with a named person responsible for regulatory communication.
- Map your data flows to third-party processors. Every processor relationship should be governed by a Data Processing Agreement as required by Article 28.
- Check whether you transfer personal data outside the EEA. Post-Brexit UK, and any transfers to countries without an adequacy decision, require appropriate transfer mechanisms such as Standard Contractual Clauses.
- Test your response to subject access requests with a simulated request before a real one arrives.
- If you process special category data or conduct large-scale monitoring, confirm whether a DPIA is required and, if one exists, whether it is current.
The Autoriteit Persoonsgegevens accepts voluntary breach reports and questions from organisations working through compliance gaps. Coming to a regulator with a remediation plan in hand is consistently treated more favourably than being found non-compliant during an audit. Our audits and compliance team works with organisations at every stage of building a GDPR programme, from initial gap assessments to ongoing DPO support.