GDPR compliance

GDPR compliance

What is GDPR compliance?

GDPR compliance means aligning an organisation’s personal data practices with Regulation (EU) 2016/679, known as the General Data Protection Regulation, and – where applicable – related national rules, including the Polish data protection framework and the practice of the President of the Personal Data Protection Office. In practical terms, it is not limited to having a privacy policy or obtaining consent. It requires a structured approach to collecting, using, storing, sharing and deleting personal data in a lawful, transparent and secure manner.

An organisation is GDPR compliant when it can demonstrate that personal data is processed on a valid legal basis, for specified purposes, in a proportionate way and with appropriate safeguards. Compliance also includes enabling data subjects to exercise their rights, such as the right of access, rectification, erasure, restriction, objection and data portability where applicable. The GDPR is built on the accountability principle, which means that it is not enough to follow the rules in substance – the organisation should also be able to prove it.

GDPR compliance applies to a wide range of entities, including companies, employers, online service providers, e-commerce businesses, healthcare entities, financial institutions and public bodies. It may also apply to organisations outside the EU if they offer goods or services to individuals in the EU or monitor their behaviour. Depending on the facts, an entity may act as a controller, a processor or both in different processing operations, which directly affects the scope of its obligations.

What does GDPR compliance involve?

GDPR compliance usually starts with identifying what personal data is processed, for what purpose, on what legal basis, for how long and with whom it is shared. This often requires mapping data flows across departments, systems, service providers and group entities. A proper assessment should also determine whether the organisation processes ordinary personal data only, or also special categories of data, criminal conviction and offence data, employee data or children’s data, which may trigger additional requirements.

From a practical perspective, GDPR compliance commonly includes preparing or updating privacy notices, retention rules, internal procedures, records of processing activities, processor agreements, authorisation frameworks and incident response processes. It may also require reviewing HR documentation, recruitment processes, websites, cookies, direct marketing practices, whistleblowing channels, CCTV, IT access management and cross-border data transfers. In some cases, a data protection impact assessment must be carried out before higher-risk processing begins.

Security is another key element. The GDPR does not impose one universal set of technical measures, but requires security appropriate to the risk. This may include access controls, encryption, backup procedures, logging, multi-factor authentication, pseudonymisation, vendor due diligence and staff training. Where a personal data breach occurs, the controller may need to notify the supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of it – unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. This timeframe comes directly from Article 33(1) GDPR.

There are also areas where interpretation may differ in practice. This concerns, for example, the distinction between controller and processor roles, the correct legal basis for certain HR or marketing operations, or the conditions for international data transfers. In such matters, the wording of the GDPR, case law of the Court of Justice of the European Union, guidance of the European Data Protection Board and local supervisory practice should be analysed together.

When is it worth seeking legal support on GDPR compliance?

Legal support is particularly useful when an organisation is implementing GDPR requirements for the first time, expanding into new markets, introducing new technologies or responding to an incident. It is also recommended in connection with audits, inspections, complaints from individuals, vendor negotiations, data-sharing arrangements, outsourcing, internal investigations, mergers, acquisitions and group reorganisations. In these situations, data protection issues often intersect with employment law, commercial law, corporate governance, IT security and sector-specific regulation.

Private individuals may also need legal support where personal data has been unlawfully disclosed, used without a valid basis, retained too long or processed in a way that interferes with privacy or reputation. Businesses, on the other hand, often seek advice when they need to assess risk, formalise their documentation, respond to requests from data subjects or verify whether their existing practices are defensible in the event of regulatory scrutiny.

Early consultation with a lawyer can help prevent avoidable mistakes, disputes, liability and financial losses. Under Article 83 GDPR, administrative fines may reach up to EUR 20 million, or in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher. Not every infringement leads to a fine at the maximum level, and supervisory authorities assess multiple factors before imposing sanctions. Even so, regulatory action, business interruption, contractual exposure and reputational harm may create material risk long before a final decision is issued.

Legal assistance in the area of GDPR compliance may include in particular:

• GDPR audits and gap assessments,
• preparation and review of privacy notices, policies and internal procedures,
• records of processing activities and retention frameworks,
• data processing agreements and vendor compliance support,
• assessment of legal bases for processing and marketing activities,
• support with data subject rights requests,
• personal data breach response and notification analysis,
• data protection impact assessments,
• cross-border data transfer analysis,
• representation in proceedings before the supervisory authority and support in disputes involving personal data.

Need support with GDPR compliance? Contact us.

See also

• Commercial Law
• Employment Contract
• Consumer Rights
• Financial reporting