The General Data Protection Regulation is formally Regulation (EU) 2016/679. As a regulation rather than a directive, it applies directly in every EU member state without needing national legislation to take effect, although member states add their own rules in some areas. It has applied since 25 May 2018. Unlike ISO 27001 or SOC 2, GDPR is law, and compliance is not something you opt into.
Who it applies to
Article 3 sets two routes into scope. An organization established in the EU is covered for processing in the context of that establishment, wherever the processing happens. An organization outside the EU is covered when it offers goods or services to individuals in the EU, or monitors their behavior there. Note that the test is about people in the Union, not EU citizenship. The United Kingdom now has its own UK GDPR, which is closely aligned but legally separate.
The vocabulary you need
The seven principles
- Lawfulness, fairness, and transparency
- Purpose limitation
- Data minimization
- Accuracy
- Storage limitation
- Integrity and confidentiality
- Accountability: being able to demonstrate compliance with all of the above
Accountability is the principle that turns GDPR into a documentation exercise as much as a behavioral one. It is why records of processing, DPIAs, processor contracts, and security evidence matter even when nothing has gone wrong.
Breaches and fines
Under Article 33, a controller must notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals. Article 83 sets two tiers of administrative fines, applied to undertakings at whichever amount is higher:
Where security frameworks fit
Article 32 requires appropriate technical and organizational security measures but does not prescribe them. An ISMS built on ISO 27001 is a common way to demonstrate that, and ISO/IEC 27701 extends it to privacy management. Neither is proof of GDPR compliance on its own, since GDPR also covers lawful basis, transparency, and individual rights. For the full obligations and how to operationalize them, see the GDPR framework page.