GDPR

at a glance

what it is

A regulation, applying since 25 May 2018.

who it covers

Anyone processing personal data. That includes your staff records.

the size line

None for security. Under 250 staff you may skip records of processing only if processing is occasional, low-risk and has no special categories.

fine ceilings

€10 million or 2% for security and breach duties. €20 million or 4% for basic principles.

who answers

The controller, and processors in their own right.

status

Applying. A proposal would lengthen the breach clock, and it is not law.

basis GDPR Art. 2(1), 30(5), 32(1), 83(4), 83(5), 99(2)

does it apply to you?

the whole job, in order

Phases, with who carries each step and the proof it leaves. Open a phase to see its steps.

• settle who answers

  Name who answers for compliance and check whether you can skip any records.

  2 steps
• see what you hold

  Record what personal data you process and where, and add the risk to people to your risk assessment.

  2 steps
• put the measures in place

  Make the measures real: access, encryption, backups and regular tests.

  4 steps
• check your processors

  Know who processes personal data for you and hold them to the terms the law lists.

  3 steps
• be ready for a breach

  Decide who judges a breach, how you tell the authority and the people affected, and how you log it.

  4 steps
• show your work

  Keep the proof together and report to management.

  3 steps

the dates

What applies when. The reference sits under each date.

1. 25 May 2018GDPR appliesGDPR Art. 99(2)applies now

the fine ceilings

The ceilings each text sets. The reference sits under each.

• security and breach dutiesup to €10 million or 2% of worldwide annual turnover, whichever is higherGDPR Art. 83(4)

  Covers GDPR Art. 25 to 39, which includes security and notification.

• basic principlesup to €20 million or 4% of worldwide annual turnover, whichever is higherGDPR Art. 83(5)

  Principles, legal basis, data subject rights, transfers.

what it asks, and ways to meet it

The rule says what must be true in the company. It names no tools or methods: you choose them, and the people implementing it and the board answer for the choice. Under each requirement are the controls that usually deliver it. That grouping is our reading of the rule, not a list from the act.

1. GDPR Art. 28(3)

   A contract with listed terms, including security, assistance and audits.

   • supplier management
2. GDPR Art. 28(4)

   The same duties passed on to any further processor, by contract.

   • supplier management
3. GDPR Art. 30(1)

   A record of processing activities.

   • asset inventory
4. GDPR Art. 32(1)

   Security appropriate to the risk to people.

   • risk register
   • AI inventory
5. GDPR Art. 32(1)(a)

   As appropriate, the pseudonymisation and encryption of personal data.

   • endpoint management
   • encryption and key management
6. GDPR Art. 32(1)(b)

   Ongoing confidentiality of processing systems, sized to risk.

   • multi-factor authentication
   • privileged access
   • access reviews
   • single sign-on and directory
7. GDPR Art. 32(1)(c)

   The ability to restore availability and access to personal data in a timely manner after a physical or technical incident.

   • backup and recovery
8. GDPR Art. 32(1)(d)

   A process for regularly testing whether security measures work.

   • vulnerability management
9. GDPR Art. 33(5)

   Document every personal data breach, with facts, effects and action taken, so the authority can verify compliance.

   • incident management
   • logging and monitoring
10. GDPR Art. 39(1)(b)

    The data protection officer monitors compliance, including awareness-raising and training of staff involved in processing.

    • awareness training

how it fits with the others

• NIS2

  GDPR sits next to the rest: almost every company handles personal data.

the work under this rule

• incident reportingFor the board and the owner of IT: one event can start three clocks at once, each to a different authority. The hours are easy to remember. The hard part is that someone must be allowed to say this counts before the investigation is finished.
• supplier riskYour suppliers' failures count as yours. NIS2, DORA and GDPR ask for the same three things: know who your suppliers are, check them in proportion, and put security in the contract.
• the board's partFor directors and the chair: security decisions now need a director's signature. A board does not have to understand firewall rules. It has to see risks, cost and choice, decide, and be able to show that it did.
• access controlFor the owner of IT: who can get in, who approved it and when someone last checked. NIS2, DORA and GDPR all ask for this, so one review done properly answers all three.
• risk assessmentEvery rule asks for measures that fit the risk. A short written assessment lets you show that yours do, and gives you an honest reason to do less where the risk is low.
• backups and recoveryFor the owner of IT and the chief executive: a backup counts once you have restored from it. One timed restore tells you more than a plan, and it leaves a record that the control runs.
• trainingNIS2, DORA and GDPR ask for training, and the AI Act adds its own. One small programme with one attendance record answers them all. The failure that shows up is having no record.
• patching and checking it worksPatch on a schedule you wrote down, handle the reports that come in, and test once a year whether the rest of your controls run. Companies skip the last part because nothing breaks when they do.