General Data Protection Regulation, Regulation (EU) 2016/679

Who it applies to

Organisations established in the European Union, and organisations outside it that offer goods or services to individuals in the Union or monitor their behaviour. Extraterritorial reach is the part most often misjudged.

What it requires

• A lawful basis for every processing activity, with consent treated as one basis among several rather than the default
• Records of processing activities under Article 30
• Data protection by design and by default, evidenced in how systems are actually built
• Data protection impact assessments where processing is high risk
• Breach notification to the supervisory authority within seventy two hours where the threshold is met
• Governance of international transfers, including transfer impact assessment where appropriate

What preparing for it involves

Organisations that have completed a serious GDPR programme are usually well positioned for the GCC privacy regimes, because those regimes borrow its structure. The reverse is less reliable: GDPR sets a higher bar on accountability, requiring an organisation to demonstrate compliance rather than simply achieve it.

How it concludes

Supervisory compliance. There is no GDPR certificate; there is documented accountability that survives examination.

SecureEdge Advisory prepares you and facilitates the process. The affirmation is made by an external auditor, a certification body or the regulator, never by us.

Cross-framework reuse

Control mappings for this framework are not yet published in the library. It is carried in full for assessment and preparation, and cross-framework reuse will follow as the mapping matures. We would rather state that plainly than imply reuse that does not exist.