GDPR

Questions we're often asked.

Why are we being asked for GDPR?

When you collect, process, store or have potential access to personal data of EU or UK residents, including customers, employees and end users, those people have rights. Your customers need to know you honour them. That extends to lawful basis, transparency, retention, vendor management and cross-border transfers, depending on the nature of your service.

Are we a controller or a processor?

You're often both, on different processing activities. Your role determines your obligations, the contracts you need in place, and how you respond to data subject requests. We help you map this per activity rather than trying to label the whole company.

Do we need a Data Protection Officer?

A DPO is required if you carry out large-scale monitoring of individuals, process special-category data at scale, or if you're a public authority. Most SaaS companies don't formally require one, but do need a named person accountable for privacy.

How do we handle international data transfers?

Transfers out of the EU/UK need a lawful transfer mechanism, typically Standard Contractual Clauses supported by a Transfer Impact Assessment. We review your vendor stack against your actual data flows, not just what's in your DPAs.

Is GDPR audited or certified?

Not in the SOC 2 / ISO sense. GDPR is enforced by supervisory authorities. What matters in practice is that your program is documented, defensible and evidenced, so you can respond credibly to a customer, a regulator or an incident.