What Is GDPR?

The General Data Protection Regulation (GDPR) is the European Union’s comprehensive data privacy law governing how organizations collect, use, store, share, and protect personal data. It establishes rights for individuals while placing obligations on the organizations that determine how personal data is processed and those that process it on their behalf.

The GDPR is built around the principle that organizations should understand what personal data they process, have a lawful reason for processing it, limit its use to legitimate purposes, protect it with appropriate safeguards, and be able to demonstrate accountability.

GDPR applies to far more than names and contact information. Personal data can include online identifiers, location information, financial data, biometric information, device information, and other data that can directly or indirectly identify an individual.

The GDPR consists of 11 chapters and 99 articles, covering everything from basic processing principles and individual rights to security requirements, international data transfers, supervisory authorities, and enforcement. Noncompliance violations are substantial, with significant administrative fines depending on the nature, severity, and circumstances of the infringement:

• Up to €10 million or 2% of worldwide annual turnover: Certain violations involving controller and processor obligations, security, and breach notification can fall into this tier.
• Up to €20 million or 4% of worldwide annual turnover: More serious violations, including breaches of core processing principles, data subject rights, and international transfer requirements, can trigger the higher tier.

Who Must Comply With GDPR?

GDPR applies to organizations established in the European Union when they process personal data in connection with their activities. But its reach is not limited to organizations physically located in the EU.

Organizations outside the EU may also fall within GDPR’s territorial scope when they process the personal data of people in the EU in connection with either:

• Offering them goods or services, whether payment is required or not
• Monitoring their behavior when that behavior takes place in the EU

That means GDPR for U.S. companies can be relevant when an American business intentionally serves people in the EU or monitors their behavior there. Simply having a website that an EU resident can access does not automatically establish that the business is offering goods or services to people in the EU.

GDPR obligations also depend on whether an organization acts as a controller, which determines the purposes and means of processing, or a processor, which processes personal data on behalf of a controller. Many organizations operate as both in different circumstances.

For software-as-a-service (SaaS) providers, that distinction is particularly important. A SaaS company may act as a processor when handling customer data on a client’s behalf while acting as a controller for other processing, such as its own employee, account, marketing, or customer relationship data. GDPR for SaaS therefore requires organizations to understand not only where their users are located but also their role in each processing activity.

What About UK GDPR?

The United Kingdom maintains its own data protection regime, commonly referred to as the UK GDPR, alongside the Data Protection Act 2018. Organizations may therefore need to assess EU GDPR requirements, UK GDPR requirements, or both depending on where they operate and whose personal information they process.

The UK GDPR applies to controllers and processors operating within the UK and can also apply to organizations outside the UK that offer goods or services to people there. UK data protection law has continued to evolve since Brexit, so organizations subject to it should consult current guidance from the Information Commissioner’s Office.

GDPR compliance is broader than implementing a set of cybersecurity tools. Organizations need policies, processes, governance, legal bases for processing, security controls, and evidence that those measures are working as intended.

Some of the most important requirements include:

Follow Data Processing Principles

Organizations must process personal data lawfully, fairly, and transparently – collected for specified purposes, minimized, accurate, retained only as needed, and secured against unauthorized access, loss, or damage.

Establish a Lawful Basis

Processing requires a valid legal basis (such as consent, contract performance, legal obligation, vital interests, public task, or legitimate interests). Sensitive "special category" data involves stricter conditions.

Respect Data Subject Rights

GDPR grants individuals rights to access, correct, delete, restrict, port, or object to data processing. Organizations must establish workflows to fulfill valid requests on time.

Apply Data Protection by Design and Default

Under Article 25, privacy safeguards must be built directly into systems and processes from the start, defaulting to minimal data collection, accessibility, and retention. As organizations adopt artificial intelligence and automated decision-making technologies, they should evaluate how personal data is collected, used, retained, and governed. AI systems may introduce additional data protection, transparency, and risk assessment considerations that should be incorporated into existing GDPR compliance programs.

Maintain Governance and Accountability

Controllers must prove compliance using policies, records, security controls, risk assessments, and training. Using third-party processors does not clear controllers of responsibility; processors must also guarantee strong technical and organizational safeguards.

Complete DPIAs When Required

Article 35 mandates a Data Protection Impact Assessment (DPIA) before initiating high-risk processing (e.g., large-scale sensitive data processing, public monitoring, or profiling). DPIAs evaluate necessity, assess risks, and document safeguards.

Prepare for Data Breaches

Organizations must maintain breach response procedures. Article 33 requires notifying supervisory authorities within 72 hours of awareness unless risk is unlikely. If a breach poses a high risk to individuals, Article 34 requires notifying them, though strong protections like encryption can waive individual notification.

Article 32 requires organizations to implement technical and organizational measures appropriate to the risks associated with processing personal data. These may include:

• Encryption and pseudonymization: Protect personal data using risk-appropriate safeguards, while securely managing the cryptographic keys behind encryption.
• Confidentiality, integrity, availability, and resilience: Maintain systems and services that protect personal data from unauthorized access, alteration, loss, or disruption.
• Recovery: Maintain the ability to restore access to personal data and supporting cryptographic services after a physical or technical incident.
• Security testing: Regularly test, assess, and evaluate whether technical and organizational safeguards remain effective.
• Authentication and access control: Apply controls appropriate to the risk, such as MFA, phishing-resistant authentication, and least-privilege access where warranted.

No single GDPR checklist can establish compliance for every organization, but the following questions can help teams identify major areas requiring attention:

• Data inventory: Do you know what personal data you process, where it resides, why it is processed, who has access, and how long it is retained?
• Lawful basis: Have you documented an appropriate lawful basis for each processing activity?
• Data minimization: Are you collecting and retaining only the data needed for legitimate purposes?
• Privacy notices: Are individuals clearly informed about how their personal data is collected and used?
• Data subject rights: Can you locate relevant information and respond appropriately to access, correction, deletion, portability, or objection requests?
• Third parties: Have you identified processors and other third parties that handle personal data and established appropriate agreements and oversight?
• International transfers: Have you evaluated applicable requirements for transferring personal data outside covered jurisdictions?
• DPIAs: Have you identified processing activities that may require a Data Protection Impact Assessment?
• DPO: Have you determined whether the organization must appoint a Data Protection Officer?
• Security controls: Have you assessed appropriate encryption, authentication, access control, monitoring, and resilience measures based on risk?
• Cryptographic governance: Do you know where encryption keys, certificates, and other cryptographic assets reside, who controls them, and how they are managed through their lifecycle?
• Incident response: Can you identify, investigate, document, and escalate personal data breaches quickly enough to address applicable notification requirements?
• Recovery: Can you restore trusted access to protected information and the cryptographic services it depends on after an incident?
• Testing and review: Do you regularly assess whether your technical and organizational safeguards remain effective?

Entrust solutions help organizations implement and govern cryptographic and identity controls that support the protection, security, and accountability requirements of GDPR. Technology alone does not establish compliance, but Entrust capabilities can help organizations protect personal data, manage access, apply security policies, and maintain evidence of the controls in place.

• The Entrust Cryptographic Security Platform provides centralized discovery, visibility, lifecycle management, and governance across keys, certificates, secrets, PKI, and HSM environments. Compliance Manager helps organizations assess cryptographic assets against security policies, identify risks and gaps, and maintain reporting and audit evidence to support ongoing governance and compliance activities.
  • PKI and certificate lifecycle management help establish trusted digital identities, protect personal data in transit, authenticate users, devices, applications, and workloads, and automate certificate issuance, renewal, and revocation across distributed environments.
  • Entrust nShield HSMs provide hardware-rooted protection for cryptographic keys and sensitive cryptographic operations, helping organizations strengthen the encryption and key-protection controls used to safeguard personal data.
• Entrust IAM helps secure access to systems and personal data with strong authentication and access controls, including phishing-resistant MFA, risk-based adaptive authentication, and low/no-code orchestration that makes it easier to apply consistent access policies across applications.