What is it?
The General Data Protection Regulation governs the processing of personal data relating to people in the EU/EEA — regardless of where the processor is located. It carries fines of up to the higher of €20 million or 4% of global annual turnover.
Roles
- Controller — decides why and how personal data is processed.
- Processor — processes on behalf of the controller (most B2B SaaS).
- Joint controllers — when two parties jointly decide purposes & means.
The six lawful bases
You must have one for every processing activity: consent, contract, legal obligation, vital interests, public task, legitimate interests (with balancing test).
Data subject rights (Art. 12–22)
Access, rectification, erasure ("right to be forgotten"), restriction, portability, objection, and rights related to automated decision-making. Default response window: one month (extendable by two months for complexity).
Key operational requirements
- Records of Processing Activities (Art. 30) — what data, why, recipients, retention, transfers, security.
- Data Protection Impact Assessments (Art. 35) — for high-risk processing.
- Data Processing Agreements (Art. 28) — between controllers and processors; SCCs for non-adequate third-country transfers (Schrems II).
- Breach notification — supervisory authority within 72 hours of awareness; affected individuals "without undue delay" if high risk.
- Data Protection Officer (Art. 37) — required for large-scale processing of special-category data, public bodies, or systematic monitoring.
Privacy by design and by default (Art. 25)
Build minimum necessary data collection, pseudonymisation/encryption, purpose limitation, retention enforcement and default-private settings into systems — and document that you did.
How iCompaas helps
iCompaas covers Article-by-Article control implementation: Records of Processing Activity (RoPA) module, DPIA workflow, DSAR intake-to-fulfilment with 30-day SLA tracking, vendor / processor register with SCC version control, and a 72-hour breach-notification playbook that produces the Supervisory Authority report and individual notice drafts.