Regulation (EU) 2016/679
Who the regulation reaches, what it asks of controllers and processors, the clock a personal data breach starts, and how fines are set.
The GDPR — Regulation (EU) 2016/679 — has governed the processing of personal data in the EU since 25 May 2018. It applies to organisations established in the EU and to those outside it that offer goods or services to people in the EU or monitor their behaviour. Controllers must process personal data on one of six lawful bases and under the Article 5 principles, and be able to demonstrate it: records of processing under Article 30, impact assessments for high-risk processing, security appropriate to the risk, contracts with processors, safeguards for transfers outside the EEA, and answers to data subjects' requests. A personal data breach goes to the supervisory authority within 72 hours unless it is unlikely to result in a risk. Fines reach €20 million or 4% of worldwide annual turnover.
Key takeaways
Scope
GDPR scope is set by what you process and whose data it is, then by where you are.
Requirements
What the regulation asks of a controller, article by article. Where a guide covers the requirement in depth, the card links to it.
Art. 5–6
Lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability — on one of six lawful bases for each processing purpose.
Art. 12–22
Information, access, rectification, erasure, restriction, portability, objection, and safeguards against solely automated decisions — answered within one month, extendable by two.
Art. 25
Privacy built into systems from the design stage, with defaults that process only the data each purpose needs.
Art. 28
Processors chosen for their guarantees and bound by a contract that sets out the subject matter, duration, instructions, security and sub-processing.
Art. 30
A written record of each processing activity — purposes, categories of data and people, recipients, transfers, retention and security — kept by controllers and processors alike.
GDPR Record of Processing Activities (RoPA): Article 30 Guide
Art. 32
Technical and organisational measures appropriate to the risk, including the ongoing confidentiality, integrity, availability and resilience of processing systems.
Art. 33–34
Notification to the supervisory authority within 72 hours unless the breach is unlikely to result in a risk, and to the people affected without undue delay when the risk is high.
Art. 35
An assessment before processing that is likely to result in a high risk — large-scale special-category data, systematic monitoring, or the kinds of processing your authority lists.
Art. 37–39
Required for public bodies and where core activities involve large-scale regular and systematic monitoring or large-scale special-category data.
Art. 44–49
Transfers outside the EEA only under an adequacy decision — such as the EU-US Data Privacy Framework for certified companies — or appropriate safeguards like standard contractual clauses.
International Data Transfers, From an Engineer's Point of View
Timeline
The regulation's own dates, and the clocks that start when a breach is discovered or a request arrives.
Overlaps
GDPR rarely arrives alone. Where it meets the other regimes you probably already run.
An ISMS is the usual evidence for Article 32 security of processing, and Annex A includes privacy and protection of personal data. It does not cover lawful basis, records of processing or data subject rights.
Most AI systems in scope also process personal data. The GDPR decides whether the processing is lawful; the AI Act adds duties on the system itself. A DPIA and an AI impact assessment often look at the same system.
A significant incident involving personal data can need both a NIS2 report and a GDPR breach notification — to different authorities, on different clocks.
The SOC 2 privacy criteria overlap with GDPR principles, and a Type 2 report evidences security well. It is not a GDPR compliance statement.
On Noru
The same control library, evidence vault and registers as the rest of your programme — not a separate project.
Engineering describes data categories, uses and subjects once, in a privacy-taxonomy YAML manifest next to the code. CI pushes it on every change, and Noru builds the systems, datasets and processing activities of your Article 30 record from it, with full version history. Existing spreadsheets can be migrated as manual activities first.
AI drafts legal bases, retention reasoning and safeguards from each activity's context. Every suggestion stays a draft until a person accepts or dismisses it, so nothing enters the register without review.
Signals in your activities — special-category data, cross-border transfers, profiling — map to the assessments they trigger, with DPIAs under Article 35 and US state assessments run from the same facts.
GDPR is included for every organisation and mapped onto the same controls as ISO 27001 and SOC 2 — the access review that answers A.5.18 is also evidence for Article 32(1)(b).
Not in the sense of ISO 27001. Article 42 allows certification mechanisms and seals approved by supervisory authorities or the European Data Protection Board, and a few exist, but none is required and none proves compliance on its own. Most organisations evidence the GDPR through their records, assessments, contracts and security.
If you process across borders from a main establishment in the EU, the authority where that establishment is acts as your lead supervisory authority under the one-stop-shop — IMY for a company headquartered in Sweden. Without an EU establishment there is no lead authority, and you can deal with any authority where the people affected live.
Authorities weigh the factors in Article 83(2) — nature, gravity and duration, intent or negligence, mitigation, previous infringements and cooperation — within two caps: €10 million or 2% of worldwide annual turnover for controller and processor obligations, and €20 million or 4% for the principles, lawful basis, data subject rights and transfers, whichever is higher.
Possibly, but nothing that changes your obligations today. The Commission's Digital Omnibus proposal of November 2025 would, among other things, require the authority to be told only of breaches likely to result in a high risk, within 96 hours and through a single entry point; as of October 2026 it is still before Parliament. A separate simplification package, provisionally agreed in June 2026 and awaiting a Parliament vote, would raise the Article 30(5) record-keeping exemption from 250 to 1,000 employees for processing unlikely to result in a high risk. Until either is adopted and published, the 72-hour rule and the 250-employee threshold stand. What has been adopted is Regulation (EU) 2025/2518, which harmonises how authorities handle cross-border cases from 2 April 2027.
Usually, but the rule comes from the ePrivacy Directive as implemented in each country, not the GDPR: storing or reading information on a device needs consent unless it is strictly necessary for the service the user asked for. Where personal data is involved, the GDPR then sets the standard for what valid consent looks like.
Regulatory references on this page were last checked on .
A 45-minute walkthrough of GDPR against your own controls, integrations and evidence.
