Oct 22, 2026

GDPR Compliance Guide: What Every Business Must Do

EU regulators have fined companies more than €7.1 billion for GDPR violations since the law took effect in 2018. €1.2 billion of that came from 2025 alone. The single largest 2025 penalty was €530 million, imposed on TikTok's parent company for unlawful international data transfers.

GDPR applies the moment you collect, store, or process anyone's personal data, regardless of your size or location. This GDPR compliance guide covers what every business must do to comply, from the seven core principles through the checklist you can act on today.

What is GDPR and Who Must Comply?

GDPR is the EU's data protection regulation, and it applies to how you collect, use, store, and share personal data. It took effect on May 25, 2018, replacing the older Data Protection Directive. The regulation applies if you're established in the EU. It also applies if you're based anywhere else in the world but offer goods or services to people in the EU, or monitor their behavior online.

GDPR can apply to organizations of any size. There is no employee or revenue threshold that automatically puts a business outside GDPR's scope. These responsibilities differ depending on whether you control the data or process it for another organization.

Seven Principles Govern Every GDPR Compliance Decision

GDPR rests on seven core principles that apply to every processing activity you carry out. The GDPR principles are explained in the table below and what each principle actually requires of you.

Principle	What It Requires
Lawfulness, fairness, and transparency	You process data on one of six lawful bases and tell people plainly what you're doing with it
Purpose limitation	You collect data only for specific purposes you've stated upfront, not for whatever you might need later
Data minimization	You collect only the data necessary for that stated purpose
Accuracy	You keep the data correct and current, and fix it when someone flags an error
Storage limitation	You keep data only as long as you need it, then delete or anonymize it
Integrity and con fidentiality	You secure the data against unauthorized access, loss, or damage
Accountability	You can demonstrate your compliance, not just claim it

GDPR Grants Data Subjects Eight Specific Rights

GDPR gives individuals eight specific rights over their own personal data. You need a working process for each one.

1. Right to be informed: Tell people what data you collect, why you collect it, and how you use it when you collect it.

2. Right of access: People can ask for a copy of the personal data you hold about them.

3. Right to rectification: People can ask you to correct inaccurate or incomplete personal data.

4. Right to erasure: People can ask you to delete their personal data, subject to certain exceptions.

5. Right to restrict processing: People can ask you to limit how you use their data while you continue to store it.

6. Right to data portability: People can request their data in a machine-readable format so they can transfer it to another service.

7. Right to object: People can object to certain types of data processing, including processing based on legitimate interests.

8. Rights related to automated decision-making: People have rights regarding decisions made solely by automated systems, including profiling.

Six Lawful Bases Determine Whether You Can Process Data at All

Before you process any personal data, you need one of six lawful bases to justify it.

Consent: The person has given clear, specific, informed agreement, and can withdraw it as easily as they gave it
Contract: The processing is needed to fulfill a contract with the person or prepare for one
Legal obligation: You're required to process the data to comply with a law, such as a court order
Vital interests: The processing could protect someone's life
Public task: The data is processed to perform a task in the public interest or under official authority
Legitimate interests: You're processing the data in a way the person would reasonably expect, and your interest isn't overridden by their rights

A Breach Must Be Reported Within 72 Hours of Discovery

You must report a personal data breach to your supervisory authority within 72 hours of becoming aware of it. This applies whenever the breach creates a risk to people's rights and freedoms.

A Breach Must Be Reported Within 72 Hours of Discovery

You don't need to know the full impact before reporting a breach. An initial report based on the information available is enough. If the risk is high, you must also notify the affected people without unnecessary delay.

GDPR breaches aren't limited to hacking. Lost data, unauthorized disclosure, and unauthorized changes can also count as breaches. Start your response with the 72-hour deadline in mind rather than waiting for the investigation to be complete.

GDPR Fines Follow a Two-Tier Structure Up to €20 Million

GDPR penalties scale with how serious the violation is. Regulators calculate the fine as either a fixed euro amount or a percentage of your global annual turnover, whichever is higher.

This table breaks down which violations fall into each tier.

Tier	Maximum Fine	Example Violations
Tier 1	€10 million or 2% of global annual turnover	Failing to maintain records of processing, skipping a required DPO appointment, inadequate breach notification procedures
Tier 2	€20 million or 4% of global annual turnover	Violating a core processing principle, ignoring lawful basis requirements, breaching data subject rights, unlawful international data transfers

A GDPR Compliance Checklist Covers Eight Core Steps

Build a documented plan around these eight steps.

A GDPR Compliance Checklist Covers Eight Core Steps

Map your data flows and maintain a record of processing activities under Article 30
Run a Data Protection Impact Assessment (DPIA) before starting any high-risk data processing activity
Set up a consent management system that records consent and makes it as easy to withdraw as it was to give
Set up an intake process for data subject access requests, since you have one month to respond
Put data processing agreements in place with every vendor that touches personal data on your behalf
Prepare a breach response plan built around the 72-hour reporting clock
Train your staff on data protection, since most breaches trace back to human error
Appoint a Data Protection Officer when your core activities include large-scale monitoring or processing special category data

Wrapping Up

GDPR compliance gets harder to manage when DPIAs, breach records, and processing documents are scattered across spreadsheets.

Effivity's Information Security Management Software puts these records in one place. You can assess processing risks, maintain a risk register, document breaches, and track reporting deadlines. The Statement of Applicability also helps you identify the controls relevant to your processing activities. Every record is timestamped and ready when you need to show your compliance evidence.

To learn more, visit Effivity’s website now!

Frequently Asked Questions

What are the GDPR compliance guidelines for small businesses?

GDPR compliance guidelines apply the same way regardless of your company size. There's no general exemption for small businesses. One narrow exception exists. If you have fewer than 250 employees, you may not need to maintain full records of processing activities under Article 30. That exception doesn't apply if your processing is regular, risks people's rights, or involves special category data.

What happens if you break GDPR compliance rules?

Breaking GDPR compliance rules exposes you to fines under the two-tier structure, up to €20 million or 4% of global annual turnover. Regulators can also order you to stop processing data entirely. Affected individuals can separately sue you for compensation, on top of any regulatory fine.

Does GDPR apply to US companies?

Yes, if your business serves people in the EU or tracks their behavior online. Your location doesn't matter. A US company with no EU offices can still fall under GDPR if it has EU customers or website visitors it tracks.

Shanker

Co-Founder & CEO at Effivity Technologies Pvt. Ltd.

Shanker brings over 20+ years of tech experience, including senior roles at Intel. At Effivity, he built the IT team from Scratch, managed budgets, and improved the product based on customer feedback. Shanker's leadership keeps Effivity at the forefront of the tech industry.

View All Posts

Improve Workflow & Profitability with Superior Integrated Management System Software free-demo

Schedule a Free Demo