# GDPR compliance: a practical implementation guide for cloud-native SaaS teams > GDPR is a regulation, not a standard: no certificate makes you "GDPR compliant", only records and engineering that let you demonstrate compliance to a supervisory authority or a customer’s privacy team. This guide covers who it applies to, how a B2B SaaS company splits controller and processor duties, a phased plan, the hardest requirements in AWS, Azure and GCP terms, the evidence to keep, and where the law stands in October 2026. - Source: https://support.icompaas.com/compliance/gdpr - Reviewed: 2026-10-08 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ## At a glance - **Legal instrument:** Regulation (EU) 2016/679, directly applicable in every EU Member State and, through the EEA Agreement, in Iceland, Liechtenstein and Norway; applied since 25 May 2018 - **Who enforces it:** National supervisory authorities, with a lead authority for cross-border processing, coordinated by the European Data Protection Board; national courts for compensation claims - **Applies to:** Controllers and processors established in the EEA, and organisations outside it that offer goods or services to, or monitor the behaviour of, people in the EEA (Article 3) - **Current text:** No amendment in force as of October 2026. Procedural Regulation (EU) 2025/2518 applies from 2 April 2027; the Digital Omnibus and Omnibus IV amendments are still proposals - **Assessment type:** No mandatory audit or certificate. Accountability: you must be able to demonstrate compliance on request. Article 42 certification is voluntary - **Typical first-time timeline:** In practice 3–6 months to a defensible baseline for a 10–500 person SaaS company; transfer, retention and DSAR engineering often runs longer - **Cycle:** Continuous. Records, DPIAs, transfer assessments and the sub-processor list are revisited on every relevant change and on a fixed review cadence - **Penalties:** Fines up to €10 million or 2% of worldwide annual turnover (Art. 83(4)) or €20 million or 4% (Art. 83(5)–(6)), whichever is higher; processing bans, transfer suspensions and damages claims ## Who GDPR applies to, and what happens if you ignore it GDPR reaches you in one of two ways ([Article 3](https://support.icompaas.com/compliance/gdpr/article-3-territorial-scope)). With an establishment in the EU or EEA — a subsidiary, an office, sometimes a small team — it covers processing in that establishment’s context, wherever the servers are. Without one, it still applies when you offer goods or services to people in the EEA or monitor their behaviour there. A US or Indian SaaS company with euro pricing, EU sales and analytics on EU users is in scope for that processing, and must designate in writing an [Article 27 representative](https://support.icompaas.com/compliance/gdpr/article-27-representatives-of-controllers-or-processors-not-established-in-the-union) in a Member State where those people are, unless the processing is occasional and low-risk. For a B2B SaaS company the trigger is usually commercial first. Every EU customer is a controller that may only use processors giving "sufficient guarantees" and must sign an [Article 28](https://support.icompaas.com/compliance/gdpr/article-28-processor) contract with you; its procurement team sends a data processing agreement (DPA) and sub-processor and transfer questions before the security review ends. Ignoring it costs three ways. Fines reach €20 million or 4% of worldwide annual turnover, whichever is higher, and in _ILVA_ (C-383/23, 13 February 2025) the Court of Justice confirmed that the cap uses the turnover of the whole undertaking, which can mean the group. Authorities can order processing or transfers to stop: the Irish DPC’s [€530 million TikTok decision](https://www.dataprotection.ie/en/news-media/latest-news/irish-data-protection-commission-fines-tiktok-eu530-million-and-orders-corrective-measures-following) (May 2025) conditionally ordered transfers to China suspended; staff there had accessed EEA user data remotely. Individuals can claim damages under Article 82. Most SaaS companies feel the commercial cost first: a deal stalled because the customer’s DPO will not sign off. ## How GDPR is structured, and what is changing The [Regulation](https://eur-lex.europa.eu/eli/reg/2016/679/oj) has 99 articles in 11 chapters, read with 173 recitals; every article is in the library below. It is not a control catalogue: it asks for measures "appropriate" to the risk, so two companies on the same stack can make different, equally defensible choices — if each documents why. Five chapters do most of the work: - **Chapter II — principles and lawful bases.** [Article 5](https://support.icompaas.com/compliance/gdpr/article-5-principles-relating-to-processing-of-personal-data): lawfulness, fairness and transparency; purpose limitation; minimisation; accuracy; storage limitation; integrity and confidentiality; accountability. [Article 6](https://support.icompaas.com/compliance/gdpr/article-6-lawfulness-of-processing) gives six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. SaaS companies rely mostly on contract (running the account), legal obligation (invoicing records) and legitimate interests (security monitoring, fraud prevention, B2B marketing, each with a written balancing test). Consent mostly covers non-essential cookies, also governed by the ePrivacy Directive. - **Chapter III — data subject rights** (Articles 12–23), answered within one month, extendable by two further months for complex or numerous requests. - **Chapter IV — controllers and processors** (Articles 24–43): by design and default, processor contracts, records, security, breaches, DPIAs and DPOs. Several duties switch on only above a threshold, so scoping decides how much applies. - **Chapter V — transfers** (Articles 44–50) and **Chapter VIII — remedies and fines** (Articles 77–84). **What changed, and what has not.** No amendment to the text is in force. Regulation (EU) 2025/2518 adds procedural rules for cross-border enforcement from 2 April 2027. The EDPB consulted on common DPIA (April 2026) and breach-notification (June 2026) templates. Two amending proposals are _not_ law. The Commission’s [Digital Omnibus](https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025/0360\(COD\)) (COM(2025) 837, November 2025) would require notifying authorities only of high-risk breaches, within 96 hours instead of 72, through a single EU reporting point; codify a relative definition of personal data; and add an AI legitimate-interest provision. In early October 2026 Parliament’s lead committees had not voted and the Council had no negotiating mandate. [Omnibus IV](https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025/0130\(COD\)) (COM(2025) 501) would widen the Article 30(5) records exemption beyond the current 250-employee threshold (to 750, as proposed); the text agreed with the Council was approved in committee on 2 July 2026 and still needs plenary and Council votes. Build to the current text. ## Scoping: roles, data, establishments and the UK Scope is every processing activity that touches personal data, not a boundary around a product. Map four things. 1. **A role per activity**, using the [EDPB’s controller and processor guidelines](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en). Customer content and end-user records: processor. Account admins, billing, support tickets, marketing, website analytics, staff: controller. Telemetry and security logs: usually controller, because you decide why they exist. Reusing customer data to train your own models or benchmark tenants makes you a controller for that purpose (Article 28(10)); deciding purposes with a partner can make you [joint controllers](https://support.icompaas.com/compliance/gdpr/article-26-joint-controllers). 2. **A data map:** categories, data subjects, systems (databases, buckets, warehouses, logs, backups, SaaS tools), regions, recipients and retention. It becomes your [Article 30](https://support.icompaas.com/compliance/gdpr/article-30-records-of-processing-activities) records, controller and processor versions. The under-250-employees exemption falls away when processing is not occasional, and a platform’s never is. 3. **Establishments.** An EU main establishment gives you one lead supervisory authority. Without one there is no one-stop-shop, and the [EDPB’s breach guidelines](https://www.edpb.europa.eu/system/files/2023-04/edpb_guidelines_202209_personal_data_breach_notification_v2.0_en.pdf) require a non-EEA controller to notify every authority whose residents are affected. 4. **Transfers, including access:** an engineer in Bengaluru querying an EU database, a US support team reading tickets, a sub-processor’s follow-the-sun desk. **The UK is a separate regime.** UK GDPR now diverges through the [Data (Use and Access) Act 2025](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), whose data protection provisions the ICO says were all in force by 19 June 2026: "recognised legitimate interests" that need no balancing test, significant automated decisions allowed on more lawful bases, with safeguards, except for special-category data, subject-access searches limited to what is reasonable and proportionate, consent exemptions for some analytics and functionality cookies, a reworded transfer test, and a complaints process that acknowledges within 30 days. The Commission renewed the UK adequacy decision on 19 December 2025 until 27 December 2031, so EU-to-UK flows need no SCCs. The costliest scoping mistakes: claiming to be "just a processor", leaving logs and warehouses off the map, and treating EU hosting as the end of the transfer question. ## Implementation roadmap The plan assumes a 20–300 person SaaS company, mostly a processor, on one or two hyperscalers. Shift the weeks; keep the order. ### Weeks 0–3: ownership and the map - Name an accountable executive and a privacy lead. Decide whether [Article 37](https://support.icompaas.com/compliance/gdpr/article-37-designation-of-the-data-protection-officer) requires a DPO; Germany’s BDSG section 38 adds a duty where at least 20 people are constantly involved in automated processing. Without an EU establishment, appoint the Article 27 representative now. - Build the data map from discovery scans and interviews with every datastore and SaaS-tool owner; tag cloud resources with owner and classification. - **Deliverables:** role matrix, data map, draft controller and processor records, gap register. ### Weeks 3–8: contracts, transfers, transparency - Publish a customer DPA covering every Article 28(3) term: documented instructions, confidentiality, Article 32 security, sub-processor authorisation and objection, help with rights requests, breaches and DPIAs, deletion or return at the end, and audits. Annex the security measures you actually run. - Publish a sub-processor list with purpose, location and transfer mechanism, a notice period for changes and an objection route. - Paper each transfer: an adequacy decision (including the DPF for certified US recipients) or the [2021 SCCs](https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj) — module 2 controller-to-processor, module 3 processor-to-processor — with a transfer impact assessment. - Rewrite privacy notices ([Article 13](https://support.icompaas.com/compliance/gdpr/article-13-information-to-be-provided-where-personal-data-are-collected-from-the-data)) to name purposes, lawful bases, retention and the third countries involved; €45 million of the TikTok fine was for not naming them. - **Deliverables:** DPA and annexes, public sub-processor page, transfer register with assessments, legitimate-interest assessments, updated notices. ### Weeks 6–16: engineering and assessments - Region pinning, keys, data-access logging, retention, a DSAR pipeline and a breach runbook (next section). - DPIAs for anything meeting an [Article 35](https://support.icompaas.com/compliance/gdpr/article-35-data-protection-impact-assessment) trigger, your authority’s published list, or two of the EDPB-endorsed WP248 criteria — AI features that score people, employee monitoring, large-scale location or health data, new combinations of datasets. - **Deliverables:** configuration exports per control, a completed test DSAR, a breach tabletop with timings, signed-off DPIAs. ### Ongoing - A privacy check in change management for new data, vendors, regions or purposes; quarterly sub-processor and transfer reviews; an annual refresh of records, DPIAs and training; a watch on the Omnibus files and DPF litigation. ## The hardest requirements, with AWS, Azure and GCP notes "Done" means a configuration export, a record and your DPA annex all say the same thing. ### [Articles 44–46 — data residency and transfers](https://support.icompaas.com/compliance/gdpr/article-44-general-principle-for-transfers) - **AWS:** a service control policy denying requests outside approved Regions on `aws:RequestedRegion`, with documented exemptions for global services such as IAM and CloudFront; the AWS European Sovereign Cloud (generally available January 2026) for EU-only operations. **Azure:** the built-in Allowed locations policy at management-group scope; Microsoft’s EU Data Boundary, completed February 2025, keeps customer, pseudonymised telemetry and support data in the EU and EFTA, with listed exceptions. **GCP:** the `gcp.resourceLocations` organisation policy; Assured Workloads EU Data Boundary packages, where "EU Data Boundary and Support" also limits support to EU personnel. - Residency is not a transfer tool: access from outside the EEA is still a transfer. The EU–US Data Privacy Framework covers only US organisations on the Department of Commerce list. The General Court [upheld it in _Latombe_](https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-09/cp250106en.pdf) (T-553/23, 3 September 2025) and an appeal (C-703/25 P) is pending. On 29 June 2026 the US Supreme Court’s _Trump v. Slaughter_ ended for-cause removal protection for FTC commissioners, whose independence the adequacy decision cites, and on 31 July the EDPB [asked the Commission to assess the effect](https://www.edpb.europa.eu/documents/edpb-correspondence/edpb-letter-to-the-european-commission-on-us-supreme-court-judgment_en). The decision [remains in force](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en); keep SCCs signed as the fallback. ### [Article 32 — encryption and key management](https://support.icompaas.com/compliance/gdpr/article-32-security-of-processing) - **AWS:** KMS customer-managed keys per data class, key policies separating key administrators from data users, the External Key Store where customers insist on keys outside AWS. **Azure:** Key Vault or Managed HSM keys on Storage, SQL Database and Cosmos DB, with purge protection. **GCP:** Cloud KMS CMEK, plus Cloud EKM and Key Access Justifications for external key custody. - **Done:** every store of personal data under a key you control, logged key use, and a risk-to-measure table. ### [Articles 33–34 — access logging and the 72-hour clock](https://support.icompaas.com/compliance/gdpr/article-33-notification-of-a-personal-data-breach-to-the-supervisory-authority) - Default logs miss data reads, so you cannot scope a breach. **AWS:** CloudTrail S3 data events and database activity streams or `pgaudit`. **Azure:** diagnostic settings with StorageRead, and Azure SQL auditing. **GCP:** Data Access audit logs, off by default except for BigQuery. Ship them to S3 Object Lock, immutable Blob storage or a locked log bucket. - Controllers notify within 72 hours of becoming aware; processors notify controllers "without undue delay", so put an hour count in the DPA. Every breach goes in the Article 33(5) register, notified or not; [Article 34](https://support.icompaas.com/compliance/gdpr/article-34-communication-of-a-personal-data-breach-to-the-data-subject) adds notice to individuals when risk is high. - **Done:** a tabletop timeline from alert to draft notification, and a register with each notify-or-not decision and its reason. ### [Articles 5(1)(e) and 17 — retention and deletion](https://support.icompaas.com/compliance/gdpr/article-17-right-to-erasure-right-to-be-forgotten) - **AWS:** S3 Lifecycle expiration, DynamoDB TTL, CloudWatch Logs retention, AWS Backup lifecycle. **Azure:** Blob lifecycle management, Cosmos DB TTL, Log Analytics retention. **GCP:** Object Lifecycle Management, BigQuery table and partition expiration, Cloud Logging bucket retention. - **Done:** every datastore has a TTL or a documented exception; tenant offboarding deletes within the contractual period and logs it; backups age out within a stated window. ### [Articles 15–20 — data subject requests](https://support.icompaas.com/compliance/gdpr/article-15-right-of-access-by-the-data-subject) - As a processor, give customer admins self-service export and deletion plus an API. As a controller, answer within one month, with [portable](https://support.icompaas.com/compliance/gdpr/article-20-right-to-data-portability) JSON or CSV output. - Keep a subject index mapping user ID and email to every store, seeded by discovery: Amazon Macie for S3, Microsoft Purview for Azure, Sensitive Data Protection for BigQuery and Cloud Storage. Microsoft Priva is built for Microsoft 365 data, not your product. - **Done:** a timed end-to-end test request covering warehouse, logs, CRM and support desk. ### [Article 25 — pseudonymisation by design](https://support.icompaas.com/compliance/gdpr/article-25-data-protection-by-design-and-by-default) - Tokenise identifiers before analytics and non-production: AWS KMS HMAC keys; Sensitive Data Protection deterministic or format-preserving encryption on GCP; dynamic data masking for Azure SQL support views. Hold the key in a separate account owned by another team. - Pseudonymised data stays personal data for whoever can re-identify it; in _EDPS v SRB_ (C-413/23 P, September 2025) the Court of Justice held it may not be for a recipient without the means. ### [Article 28(2) and (4) — sub-processors](https://support.icompaas.com/compliance/gdpr/article-28-processor) - Hyperscalers publish DPAs and sub-processor lists: AWS in its Service Terms and sub-processor page, Microsoft in the Products and Services DPA and Service Trust Portal, Google Cloud in its Data Processing Addendum and subprocessors page. - Under EDPB Opinion 22/2024, controllers should know every sub-processor down the chain, and processors must actively flag changes. - **Done:** the public list reconciles with billing and SSO app inventories, and each entry has a signed DPA and a transfer mechanism. ## Evidence to keep, and for how long Accountability (Articles 5(2) and [24](https://support.icompaas.com/compliance/gdpr/article-24-responsibility-of-the-controller)) means an authority or customer can ask you to demonstrate compliance and you must produce it. File evidence by processing activity and article, dated and owned. - **Governance:** data protection policy, retention schedule, breach and DSAR procedures, DPO designation and its notification to the authority (Article 37(7)), the Article 27 mandate, training completion. - **Records and assessments:** Article 30 records; legitimate-interest assessments; DPIAs and any Article 36 prior consultation; transfer impact assessments; proof of consent where consent is the basis (Article 7(1)); the breach register; a DSAR log with dates and outcomes. - **Contracts:** customer and sub-processor DPAs, executed SCCs with completed annexes, dated checks of recipients’ DPF certification, joint-controller arrangements. - **Technical exports:** region policies, key configuration, audit-log settings, lifecycle and TTL rules, deletion-job output, access reviews, and the regular testing Article 32(1)(d) requires — penetration, restore and vulnerability results. - **Tickets:** change-management privacy reviews, sub-processor notices to customers, incidents linked to the register. **Retention.** GDPR sets no period for compliance evidence. Keep records and contracts while the processing runs, then for the limitation period for regulatory action and damages claims in your main jurisdictions, as written in your retention schedule. DSAR logs, breach registers and consent logs hold personal data too, so minimise them. ## How GDPR compliance is actually assessed There is no GDPR audit to schedule and pass; three parties test you on their own timetable. **Customers** are the most frequent assessor: DPA negotiation, a privacy questionnaire, sub-processor and transfer questions, and Article 28(3)(h) audit rights. Most accept a SOC 2 report or ISO 27001 certificate plus a questionnaire instead of an on-site audit. **Supervisory authorities** act on complaints (Article 77), breach notifications, own-volition inquiries and sector sweeps. Article 58 powers include information orders, audits, compliance orders, temporary or permanent bans and suspension of transfers. In cross-border cases the lead authority drafts a decision, other authorities can object, and the EDPB settles disputes by binding decision (Article 65); from April 2027 Regulation 2025/2518 harmonises admissibility, procedural rights and deadlines. Fines follow the [Article 83(2)](https://support.icompaas.com/compliance/gdpr/article-83-general-conditions-for-imposing-administrative-fines) factors — gravity, duration, intent or negligence, mitigation, history, cooperation, the data affected and whether you reported it yourself. Most Chapter IV duties sit in the €10 million or 2% tier; principles, lawful bases, rights and transfers in the €20 million or 4% tier. **Certification** under Article 42 is voluntary. Europrivacy, an EDPB-approved European Data Protection Seal, was [extended in April 2026](https://www.edpb.europa.eu/news/news/2026/edpb-brings-clarity-data-processing-scientific-research-speeds-finalisation_en) to non-EEA companies under Article 3(2), and a version recognised as a transfer tool for non-EEA importers. ISO/IEC 27701 is not a GDPR certification but is common evidence of Article 28 guarantees. **Cost drivers:** a DPO, representative fees, counsel time on DPAs and transfer assessments, residency, retention and DSAR engineering, the number of sub-processors and countries, and AI features needing DPIAs. ## Common mistakes in readiness reviews 1. **"We are a processor, so GDPR is the customer’s problem."** Your account, marketing, telemetry and HR data make you a controller. Fix: a role per activity, and a controller record alongside the processor one. 2. **EU hosting treated as the transfer answer.** Support and engineering access from outside the EEA is a transfer; the Dutch authority fined Uber [€290 million](https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to-the-us) for sending drivers’ data to its US headquarters for over two years without a transfer tool. Fix: list access-based flows and cover each with SCCs or the DPF plus an assessment. 3. **A DPA that promises what engineering does not do.** "Deleted within 30 days, including backups" when backups live 90. Fix: write the annex from configuration exports and keep them in step. 4. **A stale sub-processor list.** A team adopts a new LLM API and customers find out from a questionnaire. Fix: a procurement gate tied to SSO and billing, with notice before go-live. 5. **Logs as a shadow database.** Request bodies, emails and IP addresses kept indefinitely. Fix: redaction at the logger, retention on every log group, logs on the data map. 6. **DSARs that search only production.** The warehouse, CRM, support desk and logs hold more. Fix: a subject index and a quarterly test request. 7. **The breach clock started at the post-mortem.** Awareness means reasonable certainty that personal data was compromised, not a finished investigation. Fix: timestamp awareness at triage; notify in phases if facts are incomplete. 8. **DPIAs written after launch.** An AI scoring feature ships and the assessment is reverse-engineered. Fix: a screening question in design review, signed off before release. ## How iCompaas helps iCompaas is not a supervisory authority, a law firm or your DPO, and it cannot make the controller-or-processor call for you; it is the system of record underneath the programme. The records-of-processing (RoPA) module holds your Article 30 records. A DPIA workflow supports your impact assessments. DSAR intake tracks each request through to fulfilment against its deadline. The vendor and processor register records each sub-processor with its SCC version, and the breach-notification playbook runs the 72-hour clock and drafts the supervisory-authority report and individual notices. Continuous checks run across your connected AWS, Azure, GCP and other cloud accounts, so configuration drift shows up between reviews rather than in a customer’s due diligence. Policy templates come with owners and review cadences; evidence is collected as controls run and exported when a customer or authority asks. The 99-article library on this page explains each article in engineering terms; the legal judgements remain yours. ## Frequently asked questions ### Does GDPR apply to a US company with no office in the EU? Yes, if you offer goods or services to people in the EU or EEA, or monitor their behaviour there (Article 3(2)). Signals include EU-facing pricing, languages, sales and marketing, and analytics on EU users. You then need an Article 27 representative in a Member State where those people are, unless your processing is occasional and low-risk. If you only process data on behalf of EU business customers, you are bound mainly through the Article 28 contract and the standard contractual clauses they sign with you. ### Is a B2B SaaS company a data controller or a data processor? Both, for different activities. For the customer content and end-user records you hold on a customer’s instructions you are a processor, and the customer is the controller. For your own account, billing, marketing, website, staff and usually product telemetry and security logs you are a controller. If you reuse customer data for your own purposes — training models, cross-tenant benchmarks — you become a controller for that purpose under Article 28(10). Decide the role per processing activity and record it. ### Can we still use the EU–US Data Privacy Framework in 2026? Yes. The Commission’s 2023 adequacy decision remains in force, and the General Court dismissed the Latombe challenge on 3 September 2025. Two risks remain open: an appeal before the Court of Justice (C-703/25 P), and the US Supreme Court’s June 2026 ruling removing for-cause protection for FTC commissioners, which the EDPB has asked the Commission to assess. The framework covers only US organisations certified on the Department of Commerce list, so check certification and keep SCCs as a fallback. ### Do we need a Data Protection Officer under GDPR? Only in three cases under Article 37: you are a public authority; your core activities involve regular and systematic monitoring of people on a large scale; or your core activities involve large-scale processing of special-category or criminal-offence data. The test applies to processors as well as controllers. National law can add cases — Germany requires a DPO where at least 20 people are constantly involved in automated processing of personal data. If you appoint one voluntarily, the full DPO rules on independence and tasks apply. ### How long do you have to report a data breach under GDPR? A controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to individuals. Late notifications must explain the delay. A processor must tell the controller without undue delay. If the risk is high, affected individuals must be told too. The Digital Omnibus proposal would move to 96 hours for high-risk breaches only, but it is not law as of October 2026. ### Is there an official GDPR certification? There is no mandatory certification and no certificate that makes an organisation "GDPR compliant". Article 42 allows voluntary certification schemes approved by authorities or the EDPB; Europrivacy is an approved European Data Protection Seal, and in April 2026 the EDPB approved its extension to non-EEA companies subject to GDPR and recognised a version of it as a transfer tool. Certification can support your Article 28 guarantees and is a fine-setting factor, but it does not transfer responsibility. ISO/IEC 27701 and SOC 2 reports are useful evidence, not GDPR certifications. ### How long does GDPR compliance take for a SaaS startup? In practice, three to six months to a defensible baseline: a data map and records, a customer DPA, a sub-processor list, transfer paperwork, updated notices, a DSAR process and a breach runbook. The engineering — region restrictions, retention automation, data-access logging, a subject index — often takes longer, and DPIAs for AI or monitoring features add weeks each. Compliance never finishes, because every new vendor, region, data category or purpose changes the records. ## Automate GDPR with iCompaas iCompaas connects to your cloud accounts, identity provider and version control, maps the evidence to every GDPR requirement, runs the technical checks continuously, and keeps policies and reviews on schedule. - [Get started](https://app.icompaas.com/signin?utm_source=support.icompaas.com&utm_medium=referral&utm_campaign=compliance-guides&utm_content=gdpr&utm_term=get-started) - [Book a product tour](https://calendly.com/icompaas/product-tour?utm_source=support.icompaas.com&utm_medium=referral&utm_campaign=compliance-guides&utm_content=gdpr&utm_term=product-tour) ## Related compliance guides - [ISO/IEC 27701:2025 PIMS Controls — control library](https://support.icompaas.com/compliance/iso-27701-2025): A certifiable privacy management system that many EU customers accept as evidence of the Article 28 "sufficient guarantees" and Article 32 measures. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): The security management system most EU procurement teams ask for alongside a DPA; its controls supply much of the Article 32 evidence. - [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): If engineering or support teams sit in India, the same data flows are also subject to India’s Digital Personal Data Protection Act. ## GDPR (Regulation (EU) 2016/679): control library 99 controls in 10 sections. Each control page has implementation guidance and the evidence to collect; append `.md` to any link for Markdown. ### Articles 1–10 GDPR (Regulation (EU) 2016/679) - [GDPR Article 1 — Subject-matter and objectives](https://support.icompaas.com/compliance/gdpr/article-1-subject-matter-and-objectives) - [GDPR Article 2 — Material Scope](https://support.icompaas.com/compliance/gdpr/article-2-material-scope) - [GDPR Article 3 — Territorial Scope](https://support.icompaas.com/compliance/gdpr/article-3-territorial-scope) - [GDPR Article 4 — Definitions](https://support.icompaas.com/compliance/gdpr/article-4-definitions) - [GDPR Article 5 — Principles relating to processing of personal data](https://support.icompaas.com/compliance/gdpr/article-5-principles-relating-to-processing-of-personal-data) - [GDPR Article 6 — Lawfulness of processing](https://support.icompaas.com/compliance/gdpr/article-6-lawfulness-of-processing) - [GDPR Article 7 — Conditions for consent](https://support.icompaas.com/compliance/gdpr/article-7-conditions-for-consent) - [GDPR Article 8 — Conditions applicable to child's consent in relation to information society services](https://support.icompaas.com/compliance/gdpr/article-8-conditions-applicable-to-child-s-consent-in-relation-to-information-society) - [GDPR Article 9 — Processing of special categories of personal data](https://support.icompaas.com/compliance/gdpr/article-9-processing-of-special-categories-of-personal-data) - [GDPR Article 10 — Processing of personal data relating to criminal convictions and offences](https://support.icompaas.com/compliance/gdpr/article-10-processing-of-personal-data-relating-to-criminal-convictions-and-offences) ### Articles 11–20 GDPR (Regulation (EU) 2016/679) - [GDPR Article 11 — Processing which does not require identification](https://support.icompaas.com/compliance/gdpr/article-11-processing-which-does-not-require-identification) - [GDPR Article 12 — Transparent information, communication and modalities for the exercise of the rights of the data subject](https://support.icompaas.com/compliance/gdpr/article-12-transparent-information-communication-and-modalities-for-the-exercise-of-the) - [GDPR Article 13 — Information to be provided where personal data are collected from the data subject](https://support.icompaas.com/compliance/gdpr/article-13-information-to-be-provided-where-personal-data-are-collected-from-the-data) - [GDPR Article 14 — Information to be provided where personal data have not been obtained from the data subject](https://support.icompaas.com/compliance/gdpr/article-14-information-to-be-provided-where-personal-data-have-not-been-obtained-from-the) - [GDPR Article 15 — Right of access by the data subject](https://support.icompaas.com/compliance/gdpr/article-15-right-of-access-by-the-data-subject) - [GDPR Article 16 — Right to rectification](https://support.icompaas.com/compliance/gdpr/article-16-right-to-rectification) - [GDPR Article 17 — Right to erasure ('right to be forgotten')](https://support.icompaas.com/compliance/gdpr/article-17-right-to-erasure-right-to-be-forgotten) - [GDPR Article 18 — Right to restriction of processing](https://support.icompaas.com/compliance/gdpr/article-18-right-to-restriction-of-processing) - [GDPR Article 19 — Notification obligation regarding rectification or erasure of personal data or restriction of processing](https://support.icompaas.com/compliance/gdpr/article-19-notification-obligation-regarding-rectification-or-erasure-of-personal-data-or) - [GDPR Article 20 — Right to data portability](https://support.icompaas.com/compliance/gdpr/article-20-right-to-data-portability) ### Articles 21–30 GDPR (Regulation (EU) 2016/679) - [GDPR Article 21 — Right to object](https://support.icompaas.com/compliance/gdpr/article-21-right-to-object) - [GDPR Article 22 — Automated individual decision-making, including profiling](https://support.icompaas.com/compliance/gdpr/article-22-automated-individual-decision-making-including-profiling) - [GDPR Article 23 — Restrictions](https://support.icompaas.com/compliance/gdpr/article-23-restrictions) - [GDPR Article 24 — Responsibility of the controller](https://support.icompaas.com/compliance/gdpr/article-24-responsibility-of-the-controller) - [GDPR Article 25 — Data protection by design and by default](https://support.icompaas.com/compliance/gdpr/article-25-data-protection-by-design-and-by-default) - [GDPR Article 26 — Joint controllers](https://support.icompaas.com/compliance/gdpr/article-26-joint-controllers) - [GDPR Article 27 — Representatives of controllers or processors not established in the Union](https://support.icompaas.com/compliance/gdpr/article-27-representatives-of-controllers-or-processors-not-established-in-the-union) - [GDPR Article 28 — Processor](https://support.icompaas.com/compliance/gdpr/article-28-processor) - [GDPR Article 29 — Processing under the authority of the controller or processor](https://support.icompaas.com/compliance/gdpr/article-29-processing-under-the-authority-of-the-controller-or-processor) - [GDPR Article 30 — Records of processing activities](https://support.icompaas.com/compliance/gdpr/article-30-records-of-processing-activities) ### Articles 31–40 GDPR (Regulation (EU) 2016/679) - [GDPR Article 31 — Cooperation with the supervisory authority](https://support.icompaas.com/compliance/gdpr/article-31-cooperation-with-the-supervisory-authority) - [GDPR Article 32 — Security of processing](https://support.icompaas.com/compliance/gdpr/article-32-security-of-processing) - [GDPR Article 33 — Notification of a personal data breach to the supervisory authority](https://support.icompaas.com/compliance/gdpr/article-33-notification-of-a-personal-data-breach-to-the-supervisory-authority) - [GDPR Article 34 — Communication of a personal data breach to the data subject](https://support.icompaas.com/compliance/gdpr/article-34-communication-of-a-personal-data-breach-to-the-data-subject) - [GDPR Article 35 — Data protection impact assessment](https://support.icompaas.com/compliance/gdpr/article-35-data-protection-impact-assessment) - [GDPR Article 36 — Prior consultation](https://support.icompaas.com/compliance/gdpr/article-36-prior-consultation) - [GDPR Article 37 — Designation of the data protection officer](https://support.icompaas.com/compliance/gdpr/article-37-designation-of-the-data-protection-officer) - [GDPR Article 38 — Position of the data protection officer](https://support.icompaas.com/compliance/gdpr/article-38-position-of-the-data-protection-officer) - [GDPR Article 39 — Tasks of the data protection officer](https://support.icompaas.com/compliance/gdpr/article-39-tasks-of-the-data-protection-officer) - [GDPR Article 40 — Codes of conduct](https://support.icompaas.com/compliance/gdpr/article-40-codes-of-conduct) ### Articles 41–50 GDPR (Regulation (EU) 2016/679) - [GDPR Article 41 — Monitoring of approved codes of conduct](https://support.icompaas.com/compliance/gdpr/article-41-monitoring-of-approved-codes-of-conduct) - [GDPR Article 42 — Certification](https://support.icompaas.com/compliance/gdpr/article-42-certification) - [GDPR Article 43 — Certification bodies](https://support.icompaas.com/compliance/gdpr/article-43-certification-bodies) - [GDPR Article 44 — General principle for transfers](https://support.icompaas.com/compliance/gdpr/article-44-general-principle-for-transfers) - [GDPR Article 45 — Transfers on the basis of an adequacy decision](https://support.icompaas.com/compliance/gdpr/article-45-transfers-on-the-basis-of-an-adequacy-decision) - [GDPR Article 46 — Transfers subject to appropriate safeguards](https://support.icompaas.com/compliance/gdpr/article-46-transfers-subject-to-appropriate-safeguards) - [GDPR Article 47 — Binding corporate rules](https://support.icompaas.com/compliance/gdpr/article-47-binding-corporate-rules) - [GDPR Article 48 — Transfers or disclosures not authorised by Union law](https://support.icompaas.com/compliance/gdpr/article-48-transfers-or-disclosures-not-authorised-by-union-law) - [GDPR Article 49 — Derogations for specific situations](https://support.icompaas.com/compliance/gdpr/article-49-derogations-for-specific-situations) - [GDPR Article 50 — International cooperation for the protection of personal data](https://support.icompaas.com/compliance/gdpr/article-50-international-cooperation-for-the-protection-of-personal-data) ### Articles 51–60 GDPR (Regulation (EU) 2016/679) - [GDPR Article 51 — Supervisory authority](https://support.icompaas.com/compliance/gdpr/article-51-supervisory-authority) - [GDPR Article 52 — Independence](https://support.icompaas.com/compliance/gdpr/article-52-independence) - [GDPR Article 53 — General conditions for the members of the supervisory authority](https://support.icompaas.com/compliance/gdpr/article-53-general-conditions-for-the-members-of-the-supervisory-authority) - [GDPR Article 54 — Rules on the establishment of the supervisory authority](https://support.icompaas.com/compliance/gdpr/article-54-rules-on-the-establishment-of-the-supervisory-authority) - [GDPR Article 55 — Competence](https://support.icompaas.com/compliance/gdpr/article-55-competence) - [GDPR Article 56 — Competence of the lead supervisory authority](https://support.icompaas.com/compliance/gdpr/article-56-competence-of-the-lead-supervisory-authority) - [GDPR Article 57 — Tasks](https://support.icompaas.com/compliance/gdpr/article-57-tasks) - [GDPR Article 58 — Powers](https://support.icompaas.com/compliance/gdpr/article-58-powers) - [GDPR Article 59 — Activity reports](https://support.icompaas.com/compliance/gdpr/article-59-activity-reports) - [GDPR Article 60 — Cooperation between the lead supervisory authority and the other supervisory authorities concerned](https://support.icompaas.com/compliance/gdpr/article-60-cooperation-between-the-lead-supervisory-authority-and-the-other-supervisory) ### Articles 61–70 GDPR (Regulation (EU) 2016/679) - [GDPR Article 61 — Mutual assistance](https://support.icompaas.com/compliance/gdpr/article-61-mutual-assistance) - [GDPR Article 62 — Joint operations of supervisory authorities](https://support.icompaas.com/compliance/gdpr/article-62-joint-operations-of-supervisory-authorities) - [GDPR Article 63 — Consistency mechanism](https://support.icompaas.com/compliance/gdpr/article-63-consistency-mechanism) - [GDPR Article 64 — Opinion of the Board](https://support.icompaas.com/compliance/gdpr/article-64-opinion-of-the-board) - [GDPR Article 65 — Dispute resolution by the Board](https://support.icompaas.com/compliance/gdpr/article-65-dispute-resolution-by-the-board) - [GDPR Article 66 — Urgency procedure](https://support.icompaas.com/compliance/gdpr/article-66-urgency-procedure) - [GDPR Article 67 — Exchange of information](https://support.icompaas.com/compliance/gdpr/article-67-exchange-of-information) - [GDPR Article 68 — European Data Protection Board](https://support.icompaas.com/compliance/gdpr/article-68-european-data-protection-board) - [GDPR Article 69 — Independence](https://support.icompaas.com/compliance/gdpr/article-69-independence) - [GDPR Article 70 — Tasks of the Board](https://support.icompaas.com/compliance/gdpr/article-70-tasks-of-the-board) ### Articles 71–80 GDPR (Regulation (EU) 2016/679) - [GDPR Article 71 — Reports](https://support.icompaas.com/compliance/gdpr/article-71-reports) - [GDPR Article 72 — Procedure](https://support.icompaas.com/compliance/gdpr/article-72-procedure) - [GDPR Article 73 — Chair](https://support.icompaas.com/compliance/gdpr/article-73-chair) - [GDPR Article 74 — Tasks of the Chair](https://support.icompaas.com/compliance/gdpr/article-74-tasks-of-the-chair) - [GDPR Article 75 — Secretariat](https://support.icompaas.com/compliance/gdpr/article-75-secretariat) - [GDPR Article 76 — Confidentiality](https://support.icompaas.com/compliance/gdpr/article-76-confidentiality) - [GDPR Article 77 — Right to lodge a complaint with a supervisory authority](https://support.icompaas.com/compliance/gdpr/article-77-right-to-lodge-a-complaint-with-a-supervisory-authority) - [GDPR Article 78 — Right to an effective judicial remedy against a supervisory authority](https://support.icompaas.com/compliance/gdpr/article-78-right-to-an-effective-judicial-remedy-against-a-supervisory-authority) - [GDPR Article 79 — Right to an effective judicial remedy against a controller or processor](https://support.icompaas.com/compliance/gdpr/article-79-right-to-an-effective-judicial-remedy-against-a-controller-or-processor) - [GDPR Article 80 — Representation of data subjects](https://support.icompaas.com/compliance/gdpr/article-80-representation-of-data-subjects) ### Articles 81–90 GDPR (Regulation (EU) 2016/679) - [GDPR Article 81 — Suspension of proceedings](https://support.icompaas.com/compliance/gdpr/article-81-suspension-of-proceedings) - [GDPR Article 82 — Right to compensation and liability](https://support.icompaas.com/compliance/gdpr/article-82-right-to-compensation-and-liability) - [GDPR Article 83 — General conditions for imposing administrative fines](https://support.icompaas.com/compliance/gdpr/article-83-general-conditions-for-imposing-administrative-fines) - [GDPR Article 84 — Penalties](https://support.icompaas.com/compliance/gdpr/article-84-penalties) - [GDPR Article 85 — Processing and freedom of expression and information](https://support.icompaas.com/compliance/gdpr/article-85-processing-and-freedom-of-expression-and-information) - [GDPR Article 86 — Processing and public access to official documents](https://support.icompaas.com/compliance/gdpr/article-86-processing-and-public-access-to-official-documents) - [GDPR Article 87 — Processing of the national identification number](https://support.icompaas.com/compliance/gdpr/article-87-processing-of-the-national-identification-number) - [GDPR Article 88 — Processing in the context of employment](https://support.icompaas.com/compliance/gdpr/article-88-processing-in-the-context-of-employment) - [GDPR Article 89 — Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes](https://support.icompaas.com/compliance/gdpr/article-89-safeguards-and-derogations-relating-to-processing-for-archiving-purposes-in) - [GDPR Article 90 — Obligations of secrecy](https://support.icompaas.com/compliance/gdpr/article-90-obligations-of-secrecy) ### Articles 91–100 GDPR (Regulation (EU) 2016/679) - [GDPR Article 91 — Existing data protection rules of churches and religious associations](https://support.icompaas.com/compliance/gdpr/article-91-existing-data-protection-rules-of-churches-and-religious-associations) - [GDPR Article 92 — Exercise of the delegation](https://support.icompaas.com/compliance/gdpr/article-92-exercise-of-the-delegation) - [GDPR Article 93 — Committee procedure](https://support.icompaas.com/compliance/gdpr/article-93-committee-procedure) - [GDPR Article 94 — Repeal of Directive 95/46/EC](https://support.icompaas.com/compliance/gdpr/article-94-repeal-of-directive-95-46-ec) - [GDPR Article 95 — Relationship with Directive 2002/58/EC](https://support.icompaas.com/compliance/gdpr/article-95-relationship-with-directive-2002-58-ec) - [GDPR Article 96 — Relationship with previously concluded Agreements](https://support.icompaas.com/compliance/gdpr/article-96-relationship-with-previously-concluded-agreements) - [GDPR Article 97 — Commission reports](https://support.icompaas.com/compliance/gdpr/article-97-commission-reports) - [GDPR Article 98 — Review of other Union legal acts on data protection](https://support.icompaas.com/compliance/gdpr/article-98-review-of-other-union-legal-acts-on-data-protection) - [GDPR Article 99 — Entry into force and application](https://support.icompaas.com/compliance/gdpr/article-99-entry-into-force-and-application)