GDPR explained: a practical reference guide for businesses

GDPR in two minutes

The General Data Protection Regulation protects people when organisations use information about them. It asks a practical question at every stage: why do you need these data, what permits their use, who can see them, and when will you delete them? Security is part of the answer; it cannot replace the rest.

For a small business, start with customer, employee and supplier information. Record the purpose and lawful basis of each activity, explain it to people, restrict access, set retention periods and check your providers. Prepare to answer rights requests and respond to incidents before the first emergency arrives. You do not need consent for every activity, a DPO in every company or servers exclusively in Europe.

This guide addresses owners, IT teams, developers and website operators. Last source verification: 4 November 2026. It is informational content to adapt to your organisation, not a professional legal review. References to GDPR articles identify legal obligations; authority guidance explains interpretation; the proposed workflows and deadlines for internal projects are good practices.

Contents

Who and what the GDPR covers

Regulation (EU) 2016/679 was adopted on 27 April 2016, entered into force on 24 May 2016 and has applied since 25 May 2018. It protects fundamental rights and supports the movement of personal data under common safeguards. The EEA also applies the framework through its own arrangements. National legislation still matters, particularly for employment, children and electronic marketing.

Article 2 covers automated processing and manual information forming, or intended to form, part of a filing system. A structured paper recruitment archive can qualify. A purely personal or household activity is excluded, but a business cannot invoke that exception for its customer list. Other exclusions include activities outside EU law and certain law-enforcement processing governed by separate legislation.

Article 3 covers processing in the context of an EU establishment, even when the processing happens elsewhere. An organisation outside the EU may also be covered when offering goods or services to people in the Union, including free services, or monitoring their behaviour there. Mere website accessibility is not necessarily targeting. Currency, delivery offers, language and advertising help assess the situation together.

Citizenship is not the test. An American visitor in the Union may be covered; an EU citizen abroad does not automatically bring every foreign transaction within scope. Freelancers, charities, public authorities and small companies can all have duties. Apply the scope analysis to each activity rather than declaring the entire organisation exempt. Law: articles 2–3.

Recognising personal and sensitive information

Personal data relate to an identified or identifiable natural person. Names, work email addresses, customer numbers, location records and IP addresses may qualify. Information about a company can also identify its sole trader or contact person. Information is still personal when identification requires combining it with another reasonably available source.

Article 9 provides additional protection for racial or ethnic origin, political opinions, religion, trade-union membership, genetic data, biometric data used for unique identification, health, sex life and sexual orientation. Processing normally needs both an article 6 basis and an applicable article 9 exception. An ordinary photograph is not automatically special-category biometric data. Criminal convictions and offences have a separate article 10 regime requiring official control or legal authorisation with safeguards.

Pseudonymisation separates identifiers from records, for example replacing a name with an employee code and protecting the lookup table. The information remains personal data. Hashing an email address does not establish anonymity if it can still be matched or guessed. Anonymisation requires that identification is no longer reasonably likely, taking account of available means, cost, time and technology.

For developers, test exports, logs, analytics events and support attachments as carefully as production databases. A URL containing an email address can leak through logs and referrers. Prefer synthetic test data and remove unnecessary identifiers at the source. These are implementation practices supporting minimisation, rather than independent statutory prescriptions. Law: article 4, articles 9–10 and recital 26.

Assigning responsibility, DPOs and representatives

The controller determines purposes and essential means. A processor handles data on the controller's behalf and instructions. Your shop generally controls its order records; its contracted hosting provider may be a processor. A provider can separately control its own billing or fraud-prevention activity. The contract's label does not override what each party actually decides.

Joint controllers jointly determine purposes and means. Article 26 requires a transparent allocation of responsibilities, with the essence made available to people. Individuals can still exercise rights against each controller. A processor that starts deciding its own purposes may become a controller for that processing. Draw the relationship for each data flow instead of assigning one permanent label to an entire company.

A DPO is mandatory for public authorities or bodies, except courts acting judicially, and where core activities involve regular systematic monitoring on a large scale or large-scale processing of article 9 or article 10 data. Member State law can add cases. The DPO advises, monitors and cooperates with authorities; management remains accountable. Ensure independence, resources, access to senior management and no conflicting duties. An external shared DPO is possible when the conditions are met.

An organisation caught by article 3(2) generally needs an EU representative under article 27. The exception is limited: processing must be occasional, not involve large-scale special-category or criminal data, and be unlikely to risk rights and freedoms; public authorities have a separate exception. A representative is not a DPO. People may complain to a supervisory authority, including where they habitually live, work or allege an infringement. Articles 26–29, 37–39 and 77.

Principles and the six lawful bases

Article 5 requires lawfulness, fairness, transparency, specified purposes, minimisation, accuracy, limited retention and appropriate security. Accountability means demonstrating how these principles were applied. A spreadsheet recording actual decisions is more useful than a polished policy nobody follows. Every purpose needs its own analysis before collection starts.

Contract necessity is narrow: including advertising in your terms does not make behavioural advertising necessary to deliver a purchased product. Legal obligation requires an applicable legal rule, not merely your internal policy. Public-interest processing needs a legal foundation. Public authorities cannot use legitimate interests for processing performed in their public tasks. Articles 5–6.

For legitimate interests, document the specific legitimate purpose, why processing is necessary, and a balance against people's rights, expectations and impact. Consider less intrusive options and safeguards, especially for children or vulnerable people. A security log with limited access and short justified retention is easier to defend than indefinite monitoring of all employee activity. This assessment is often called an LIA; the acronym is not a substitute for reasoning.

For each activity, record a sentence such as: “We retain billing identity to issue invoices under the applicable accounting obligation; marketing preferences are held separately.” Different purposes can have different bases. Do not silently switch from consent to legitimate interests after someone withdraws permission merely to continue the same activity.

Consent, children and retention

Valid consent is freely given, specific, informed and unambiguous, expressed by an affirmative act. Silence, pre-ticked boxes and a general acceptance of terms do not establish it. Separate optional purposes, explain the controller and use, keep evidence of the wording and choice, and make withdrawal as easy as giving consent. Withdrawal does not invalidate earlier lawful processing. Explicit consent is needed in some special situations, including certain article 9 exceptions.

An employer should be particularly cautious about consent because a worker may not feel free to refuse. Avoid requiring unnecessary permissions to receive a service. Keep the consent record proportionate: the purpose is to prove the decision, not collect a new identity dossier. A useful record includes notice version, purpose, time, collection channel and withdrawal status. Articles 4(11), 7 and 9.

Article 8's default age is 16 for consent-based information-society services offered directly to children; national law can lower it to 13. France uses 15 in this setting, with joint child and parental consent below that age; Spain sets its national consent threshold at 14. These are not universal ages for all contracts or all processing. Verify the applicable country, service and legal basis, and use proportionate age and parental-authority checks. Commission, CNIL, AEPD.

The GDPR sets no single retention period for all records. Define an active period, any restricted archive needed for legal duties or claims, and deletion or anonymisation. Verify national tax, employment and limitation rules. Record the trigger, duration, rationale, owner and deletion method. Account closure can remove a profile while legally required invoices remain access-restricted. Include exports and backups in the lifecycle, with safeguards against restoring deleted data into active use.

Rights, exceptions and response deadlines

People must receive clear information about purposes, bases, recipients, transfers, retention, rights and contact details. Articles 13 and 14 distinguish collection from the person and collection elsewhere. In the latter case, information is generally due within a reasonable period of no more than one month, or sooner on first communication or disclosure, subject to specified exceptions.

Access includes confirmation, a copy of personal data and contextual information. Rectification corrects inaccuracies. Erasure applies in defined situations, but legal obligations, expression, public-interest grounds and legal claims can justify exceptions. Restriction can preserve data while a dispute is assessed. Notify relevant recipients of rectification, erasure or restriction unless impossible or disproportionate, and explain recipients on request.

Portability concerns data provided by the person, processed automatically on consent or contract, in a structured commonly used machine-readable format. It does not cover every internal analysis or paper archive. Opposition applies particularly to public-interest and legitimate-interest processing, subject to the relevant conditions. Opposition to direct marketing must stop that use, including associated profiling.

Respond without undue delay and within one month. Complexity or number of requests can justify two additional months, but notify the person within the original month with reasons. Requests are generally free; manifestly unfounded or excessive requests can justify a reasonable fee or refusal, with the burden on the controller. Request identity evidence only where reasonable doubts exist and in proportion to risk. Explain refusals and complaint or judicial remedies. Articles 12–21.

Article 22 limits solely automated decisions producing legal or similarly significant effects. Contract necessity, legal authorisation or explicit consent can create exceptions with safeguards; special-category data face additional restrictions. Where applicable, explain the logic meaningfully and enable human intervention, a viewpoint and contestation. A human who simply accepts a machine score without authority to reconsider is a poor safeguard.

Worked example: access and account deletion

A customer emails “Send my data and close my account.” Route this as two rights requests, record the receipt date and acknowledge it. Verify identity through an existing authenticated channel when possible. Do not demand a passport by default. Ask for clarification if genuinely needed, without using it to obstruct the request or assuming the statutory clock automatically pauses.

Search the account service, orders, CRM, support system, marketing tool and relevant processors. Ask each owner for data and contextual information. Protect other people's rights when preparing the copy: redact unrelated personal information where justified rather than refusing the whole request. A documented export with explanations is often more useful than a folder of unexplained database tables.

Erase data for which no remaining ground exists, stop marketing and explain retained records, their legal basis, access controls and retention period. Keep a minimal suppression record where necessary to honour an objection. Schedule backup expiry and ensure restore procedures reapply deletion. Send the access copy securely within the applicable deadline and describe what was done and what was retained.

Close the internal ticket with evidence of searches, decisions, processor instructions and delivery. Revisit the process if one forgotten system caused a delay. The organisation needs repeatable handling, not an elaborate identity investigation for every simple request. This example is an operational method for the legal duties in the preceding section, not a universal compulsory workflow.

Building a proportionate compliance programme

Map activities rather than listing software alone. For each purpose, identify people, fields, source, recipients, storage, access, basis, retention and transfers. For example, “candidate selection” is an activity; the recruitment platform is one system supporting it. Include paper records, shared drives, personal work accounts and processors' support access.

Article 30 records contain prescribed information for controllers and, separately, processors. The under-250-person derogation is limited: it does not cover processing that is non-occasional, likely to risk rights and freedoms, or includes article 9 or article 10 data. Routine payroll and customer management often make the occasional-processing condition unavailable. A small headcount never exempts the business from the entire regulation.

Write layered privacy information that matches actual practices. A short form notice should state the essentials and link to more detail; a generic template mentioning tools you do not use misleads people. Establish a contact route monitored by a named owner, including absence cover. Train support, HR, marketing and engineering on their own decisions rather than giving everyone only a yearly presentation.

The article 28 processor agreement must address instructions, confidentiality, security, assistance, subprocessors, return or deletion and audit information. Verify guarantees before appointment and monitor them. Subprocessors need prior specific or general written authorisation; with general authorisation, changes require notice and an opportunity to object. A provider's assurance that it is “GDPR ready” does not answer these questions. Articles 24, 28 and 30.

Privacy by design, DPIAs and practical security

Article 25 makes protection part of design and defaults. Start with a minimal registration form, optional public profiles disabled, short log retention, role-based access and an actual deletion path. Before adding a feature, ask whether the same purpose works with fewer fields or local computation. Review telemetry and crash reports: their convenience does not remove the need for a basis and transparency.

A data protection impact assessment is required before processing likely to create high risk. Article 35 identifies examples including certain extensive automated evaluations, large-scale sensitive-data processing and systematic large-scale monitoring of public areas. Check the relevant authority's mandatory and exemption lists. Not every new database requires a DPIA, but record why a screening found it unnecessary.

A useful DPIA describes the activity, tests necessity and proportionality, assesses risks to people and specifies mitigations with accountable owners. Seek DPO advice where appointed. If high residual risk remains despite measures, article 36 requires prior consultation with the supervisory authority. A completed form without changing an unsafe design is not an effective assessment.

Article 32 requires security appropriate to risk, considering context, current technology and implementation costs. Practical options include unique passwords, MFA or passkeys, least privilege, timely offboarding, encryption, secure password hashing, tested backups, patching and monitoring. Test recovery as well as prevention. These controls are examples, not a universal list mandated word for word. Use the site's 2FA guide and password policy generator to support account practices; neither certifies compliance.

Websites, cookies, marketing and online shops

The GDPR governs personal-data processing; national rules implementing ePrivacy also govern storage or access on devices and electronic communications. A cookie may require consent even before debating its personal-data content. Strictly necessary technologies can be exempt under the relevant rules; advertising trackers ordinarily cannot borrow that exemption merely because ads finance the website.

Block non-exempt trackers until a valid choice, explain purposes and recipients, provide a genuine refusal route and allow later withdrawal. Audit what actually loads, including embedded video, chat widgets and server-side forwarding. A banner whose “reject” button leaves advertising requests running does not solve the problem. Audience measurement can have narrow national exemptions with conditions; “analytics” is not an automatic exemption. CNIL guidance.

On forms, require only fields needed for the stated task. A delivery address belongs in an order, not necessarily in a newsletter subscription. Separate transactional messages from promotions. For French consumer email marketing, prior consent is generally required, with a limited existing-customer exception for similar offerings under conditions. Merely opening an account does not create that exception. Professional outreach can follow different conditions where relevant to the person's profession, with information and easy objection. Other countries and communication channels need their own checks. CNIL.

An ecommerce owner should separate fulfilment, accounting, support and marketing purposes, limit payment-data exposure and verify plugins. Retain proof of consent where relied on, and maintain unsubscribe suppression rather than repeatedly reimporting deleted contacts. Privacy information, terms of sale and cookie controls serve different functions. HTTPS protects transport; it does not determine whether collection, retention or marketing is lawful.

Cloud, SaaS and generative AI

Before choosing a CRM, cloud drive or collaboration service, identify the contracting entity, data locations, support locations, subprocessors, access controls, retention, incident assistance and exit options. Review service settings, not only the supplier's marketing page. An EU storage region does not rule out access from a third country. The business remains responsible for selecting and configuring suitable services.

For generative AI, entering a real support ticket or applicant CV into a prompt can disclose personal data to another organisation. Determine roles and bases, minimise input, assess special-category data, explain relevant uses and review transfers. Check whether prompts train models, how long conversations and logs remain, who reviews them and whether deletion reaches downstream copies. A “no training” setting addresses only one part of the assessment.

Good internal practice is to approve specific tools and permitted data categories, give staff synthetic examples, and offer a route to request an exception. Redact identifiers before use and remember that a rare diagnosis or detailed job history can identify someone without a name. Apply access restrictions to generated outputs as well as prompts.

The EDPB's opinion 28/2024 examines AI models, anonymity and legitimate interests case by case; it is authority interpretation, not a blanket permission to train on public information. Public availability does not remove personal-data protection. Assess automated hiring or other consequential decisions under article 22 as well. Verify outputs before relying on them: inaccurate personal information can create another rights problem. EDPB AI opinion.

International transfers: select the right mechanism

Chapter V does not require all data to stay in Europe. First determine whether a transfer occurs, including qualifying remote access by a separate entity in a third country. Then identify a mechanism covering the recipient and purpose. An article 6 basis for processing and a chapter V transfer mechanism answer different questions; one does not replace the other.

An adequacy decision can permit transfers within its scope without article 46 safeguards. The Commission's list consulted for this guide includes the EU–US Data Privacy Framework for participating US organisations. Verify the exact recipient's active participation and covered data, rather than assuming every US vendor is included. Canada's adequacy finding has a defined commercial scope; it is not blanket approval for every Canadian recipient. Commission's current list.

Where adequacy does not cover the transfer, article 46 tools include appropriate standard contractual clauses, binding corporate rules and other permitted safeguards. Select the applicable clauses and modules, assess third-country law and practice, and implement supplementary measures where needed. Contract signatures alone cannot neutralise a conflicting access regime. If adequate protection cannot be achieved, the transfer must not proceed on that arrangement.

Article 49 derogations are narrow and should not become the default infrastructure for routine transfers. Explicit informed consent to a particular risky transfer is not a convenient substitute for an ongoing supplier strategy. Track changes to decisions, recipient status and access arrangements over time. The previous Privacy Shield is not the current DPF. Document your check date and reassess before a new disclosure rather than relying permanently on this guide's verification date.

Data breaches: documentation, 72 hours and high risk

A personal-data breach is a security breach causing accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data. A misaddressed payroll email, ransomware blocking records or a lost unencrypted laptop may qualify. A breach need not involve a hacker, and lack of proven theft does not establish absence of risk.

Contain the event, preserve evidence, establish what happened and assess potential effects on people. Record the data categories, approximate people and records, exposure, protective measures and remedial action. Every personal-data breach must be documented, including the reasoning when no notification is required. Processors inform controllers without undue delay; do not assume their only duty is to wait 72 hours.

The controller notifies the competent authority without undue delay and, where feasible, within 72 hours after becoming aware, unless the breach is unlikely to result in a risk to rights and freedoms. Explain delay and supply information in phases where necessary. You do not need a finished forensic report to make an initial notification. Article 33.

Inform affected people without undue delay when high risk is likely, subject to article 34 exceptions, such as effective protection rendering data unintelligible or subsequent measures removing likely high risk. This is a different threshold and obligation, not a universal 72-hour email to everyone. Use plain language about the event, likely consequences, measures and contact point. Avoid messages that ask people to reveal passwords or provide opportunities for phishing.

Five practical cases and the evidence to keep

SME: A twelve-person agency keeps payroll, client contacts and freelancer files in shared folders. It inventories purposes, restricts payroll to authorised staff and removes access at departure. Ordinary recurring processing means it cannot simply rely on the small-employer record exemption. Keep the inventory, access review and documented retention decisions. Assign one business owner for each activity instead of making the IT provider answer every legal question.

Ecommerce: A shop needs address and contact details to fulfil an order, and invoice records for applicable legal duties. It asks separately about optional promotional email, subject to national exceptions. It blocks advertising trackers before consent and checks that rejection actually works. Keep a sample form, consent wording version, tracker audit and supplier agreements. A customer refusing advertising must still be able to complete an ordinary order without unnecessary data collection.

SaaS: A project-management provider processes customer workspace content on instructions but controls some billing records. It documents these roles separately, offers the article 28 terms, reviews subprocessors and establishes tenant-specific export and deletion. The same product may require different legal analyses for its functions. Keep the role map, security evidence and transfer assessment, and test that an export does not disclose another customer's records.

Recruitment: An employer receives CVs and interview notes. It limits access, informs candidates, sets a justified period and separately examines any future talent pool. It avoids collecting medical history by default and checks the need for a DPIA or article 22 safeguards before automated ranking. Keep the notice, screening criteria, retention rule and evidence that a reviewer can genuinely change a proposed decision.

Incident: An employee sends a salary spreadsheet to the wrong external address. The team asks the recipient to stop use and delete it, verifies available evidence, contains further exposure and assesses identity theft, confidentiality and employment harms. It documents the event and makes the article 33 and 34 decisions separately. A recipient's reassurance is relevant evidence, not automatic proof that there is no risk. Keep times, assessment, communications and remedial action.

Sanctions, costs and common misconceptions

Authorities can investigate, warn, reprimand, order compliance, restrict processing and suspend transfers. Article 83 provides ceilings up to €10 million or 2% of worldwide annual turnover, or €20 million or 4%, depending on the infringement; for an undertaking the higher applicable amount is the ceiling. These are maximums, not automatic tariffs. Gravity, duration, intent, mitigation, cooperation, prior infringements and other factors influence the outcome. Compensation under article 82 is a separate issue. Articles 58 and 82–83.

There is no universal compliance price. Estimate internal time for mapping, notices, contracts, engineering changes, training and request handling, then external advice or assessment where needed. Budget recurring supplier checks and incident exercises. A cheap generic document can be expensive if it masks a real deletion failure. Prioritise concrete risks and missing legal foundations, not only visible website text.

Myths to retire: consent is not the basis for every activity; fewer than 250 workers is not blanket exemption; DPOs are not compulsory everywhere; citizenship does not define territorial scope; erasure has exceptions; 72 hours is not a universal deadline to notify individuals; EU-only hosting is not mandatory; and a cookie banner, TLS certificate or automated score does not demonstrate complete compliance.

Other jurisdictions: UK GDPR is a separate regime, including UK legislative changes and guidance. Canadian federal and provincial laws, and Quebec's private-sector legislation amended by Law 25, have their own scope, rights and incident rules. Compliance with one does not establish compliance with another. The site's Law 25 guide gives local context; identify applicable regimes before adapting a European template.

Operational checklist and adaptable 30/60/90-day plan

• □ Scope and applicable national rules identified
• □ Purposes, data flows and article 30 records reviewed
• □ Bases and any article 9/10 conditions documented
• □ Notices match actual systems and recipients
• □ Retention, export and deletion tested
• □ Rights contact, owner and absence cover established
• □ Processor contracts and subprocessor changes reviewed
• □ Transfer mechanism and recipient status checked
• □ DPO, representative and DPIA requirements assessed
• □ Least privilege, MFA and recovery tested
• □ Cookies and marketing rejection verified in practice
• □ AI uses approved with input and retention restrictions
• □ Breach register and separate authority/individual decisions prepared
• □ Staff trained and periodic review owners named

Days 1–30: discover and contain. Name a lead, identify applicable laws, map critical activities and providers, fix exposed access and establish a rights inbox and incident escalation route. Deliver an initial record, a prioritised risk list and named owners. Do not postpone urgent security or unlawful-processing problems until the next phase.

Days 31–60: align documents and systems. Select and document bases, rewrite notices, sign or repair processor terms, check transfers, implement retention and correct cookie or marketing flows. Screen high-risk projects for DPIAs. Deliver evidence from an actual deletion or export test, rather than relying only on a documented promise.

Days 61–90: exercise and maintain. Simulate a request and breach, test restoration, train relevant teams and review supplier evidence. Have management accept priorities and allocate resources to remaining work. Establish review triggers for new tools, purposes, acquisitions, laws and incidents. This is an adaptable project framework, not a legal grace period or a guarantee of compliance in ninety days.

Glossary

Processing: any operation on personal data, including storage and deletion. Data subject: the person to whom data relate. Controller: the actor determining purposes and essential means. Processor: the actor processing on a controller's behalf. Joint controllers: actors jointly determining purposes and means. DPO: independent advisory and monitoring function where appointed. EU representative: designated contact under article 27, distinct from the DPO. DPIA: assessment of high-risk processing and mitigations. SCCs: standard contractual clauses used for specified transfers. Pseudonymisation: separation of identity with additional information retained. Anonymisation: removal of reasonable identifiability. Breach: security event affecting confidentiality, integrity or availability of personal data.

Frequently asked questions by theme

Scope and responsibilities

Does a freelancer have duties?

Yes, if covered processing occurs. The size of the business does not remove the need for a basis, information and security. Read the section.

Are charities exempt?

No general charity exemption exists. Membership, fundraising and volunteering records require analysis, including sensitive information where relevant. Read the section.

Does every foreign website fall within scope?

No. Assess establishment, offering to people in the Union and monitoring there; accessibility alone does not settle it. Read the section.

Is an IP address personal data?

It can be when it relates to an identifiable person. Review the context and available means of identification. Read the section.

Does hashing anonymise an email?

Not necessarily. Matchable or guessable identifiers can remain personal data; pseudonymisation is not anonymity. Read the section.

Do we always need a DPO?

No. Apply article 37 and relevant national requirements; still assign operational responsibilities when no DPO is mandatory. Read the section.

Can the IT provider be our DPO?

Possibly, but independence, expertise, resources and conflicts must be assessed. Managing the systems can conflict with monitoring those decisions. Read the section.

Is a representative the same as a DPO?

No. The article 27 representative provides a designated EU contact; the DPO advises and monitors under different conditions. Read the section.

Lawful use and retention

Must customers consent to invoices?

Not generally. Applicable legal obligations may support required billing retention; optional marketing is a different purpose. Read the section.

Can consent be pre-ticked?

No. Consent requires a clear affirmative choice and the other validity conditions, including genuine freedom and information. Read the section.

Can we rely on legitimate interests for everything?

No. Identify a legitimate purpose, necessity and a favourable balance; separate rules may still require consent. Read the section.

Are children's ages identical across Europe?

No. Article 8 permits national thresholds between 13 and 16 for its specified context; other laws and bases need separate analysis. Read the section.

How long may we retain customer files?

Only as long as justified for each purpose, including applicable legal retention. Document periods and review deletion in actual systems. Read the section.

May public information be reused freely?

No. A public profile can still contain personal data. A new purpose needs its own lawful and fair assessment. Read the section.

Individual rights

Is erasure unconditional?

No. Legal duties and other article 17 exceptions can require retention. Explain the specific reason and limit the remaining use. Read the section.

Do we have thirty days to respond?

The rule is one month, without undue delay. An extension requires the conditions and timely notice, not silence until month three. Read the section.

Should every requester send ID?

No. Ask for extra identification when reasonable doubts exist, using proportionate measures and existing authenticated channels where appropriate. Read the section.

Does access include every original document?

The right concerns personal data and context; copies of documents may be needed for an intelligible copy, while protecting others' rights. Read the section.

Does portability include all internal scores?

No. Its scope is limited to qualifying data provided by the person and automated consent- or contract-based processing. Read the section.

Can a person stop direct marketing?

Yes. Stop that processing and associated profiling after objection; retain only a justified minimal suppression record where necessary. Read the section.

Websites and suppliers

Is a cookie banner sufficient?

No. The actual tracker behaviour, information, choices and underlying processing must comply; a decorative banner proves little. Read the section.

Are all analytics exempt from consent?

No. Any exemption depends on the relevant national conditions and configuration. Advertising reuse can prevent an exemption. Read the section.

Does opening an account allow newsletters?

Not automatically. Analyse national marketing rules and the actual relationship; the French customer exception requires more than registration. Read the section.

Must all servers be in the EU?

No. Lawful transfers are possible with applicable chapter V mechanisms, alongside the rest of the GDPR. Read the section.

Does EU hosting eliminate transfers?

Not necessarily. Examine separate third-country entities, support access and onward transfers, not only the disk's location. Read the section.

Can employees paste CVs into AI tools?

Only after assessing the specific use, roles, basis, data minimisation, security and transfers. Public availability or a paid account is insufficient. Read the section.

Incidents and implementation

Does every incident require authority notification?

Every personal-data breach needs documentation; authority notification is required unless risk is unlikely. Not every IT fault is a personal-data breach. Read the section.

Must everyone be told within 72 hours?

No. The 72-hour authority rule and the high-risk duty to inform individuals have different thresholds and timing. Read the section.

Are fines always four percent?

No. There are different maximum tiers and case-specific factors, alongside corrective powers and potential compensation. Read the section.

Can a ninety-day plan certify compliance?

No. It organises priorities and evidence; scope, risk and unresolved issues determine the work, and compliance must continue over time. Read the section.

Sources, verification and legislative watch

The linked regulation is the primary legal source. EUR-Lex's direct page presented an automated-access challenge during this research; the regulation was also consulted through the Spanish official gazette, BOE. The EDPB small-business guide helps connect duties to everyday work; CNIL guidance adds operational and national detail; the Commission supplies scope and transfer resources. Authority guidance supports interpretation and does not replace legislation or binding court decisions.

The comparison also covered GDPR.eu, a non-official explanatory site, and the IT Governance guide now redirected to GRC Solutions. GDPR.eu offers an approachable overview but its inspected page confuses breach notification to individuals with the 72-hour authority rule and oversimplifies children's consent. GRC's overview is useful for locating implementation topics, with a commercial service orientation. Neither is used here to establish a legal duty. Our practical cases, decision records and roadmap are original editorial tools.

At verification, the Parliament's dossiers for Omnibus IV and the Digital Omnibus still described legislative procedures in progress. Proposed record-keeping relief and changes to breach rules must not be treated as applicable merely because announced. This guide therefore uses the existing article 30 conditions and 72-hour article 33 rule; revisit the dossiers and Official Journal before acting on a proposed change. We did not establish a future enactment date. Omnibus IV, Digital Omnibus.

• Regulation (EU) 2016/679 — EUR-Lex
• Reglamento (UE) 2016/679 — BOE
• EDPB / CEPD — SME guide
• European Commission — Data protection
• CNIL — Comprendre le RGPD
• European Commission — Children
• CNIL — Consentement
• AEPD — Menores y consentimiento
• CNIL — Cookies et publicité
• CNIL — Prospection électronique
• EDPB / CEPD — Opinion 28/2024
• European Commission — Adequacy decisions
• European Parliament — 2025/0130(COD)
• European Parliament — 2025/0360(COD)
• GDPR.eu — What is GDPR?
• GRC Solutions — Data protection