# GDPR — overview

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_overview_gdpr-gdpr-overview
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GDPR](https://support.icompaas.com/support/solutions/62000112722) › [Overview](https://support.icompaas.com/support/solutions/folders/gdpr-overview)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

GDPR · Regulation (EU) 2016/679 — applies to all processing of EU/EEA personal data

### What is it?

The **General Data Protection Regulation** governs the processing of _personal data_ relating to people in the EU/EEA — regardless of where the processor is located. It carries fines of up to the higher of **€20 million or 4% of global annual turnover**.

### Roles

-   **Controller** — decides why and how personal data is processed.
-   **Processor** — processes on behalf of the controller (most B2B SaaS).
-   **Joint controllers** — when two parties jointly decide purposes & means.

### The six lawful bases

You must have one for every processing activity: consent, contract, legal obligation, vital interests, public task, legitimate interests (with balancing test).

### Data subject rights (Art. 12–22)

Access, rectification, erasure ("right to be forgotten"), restriction, portability, objection, and rights related to automated decision-making. Default response window: **one month** (extendable by two months for complexity).

### Key operational requirements

-   **Records of Processing Activities (Art. 30)** — what data, why, recipients, retention, transfers, security.
-   **Data Protection Impact Assessments (Art. 35)** — for high-risk processing.
-   **Data Processing Agreements (Art. 28)** — between controllers and processors; SCCs for non-adequate third-country transfers (Schrems II).
-   **Breach notification** — supervisory authority within **72 hours** of awareness; affected individuals "without undue delay" if high risk.
-   **Data Protection Officer (Art. 37)** — required for large-scale processing of special-category data, public bodies, or systematic monitoring.

### Privacy by design and by default (Art. 25)

Build minimum necessary data collection, pseudonymisation/encryption, purpose limitation, retention enforcement and default-private settings into systems — and document that you did.

### How iCompaas helps

iCompaas covers Article-by-Article control implementation: Records of Processing Activity (RoPA) module, DPIA workflow, DSAR intake-to-fulfilment with 30-day SLA tracking, vendor / processor register with SCC version control, and a 72-hour breach-notification playbook that produces the Supervisory Authority report and individual notice drafts.

## Related compliance guidance

- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): How the Regulation fits together as a programme — lawful bases, Article 28/30/32/33 obligations, transfers and the DPIA process.
- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): If you also serve users in India, the DPDP Act borrows GDPR concepts but differs on consent, breach reporting and transfers.