Privacy & data protection
GDPR
GDPR (General Data Protection Regulation)
The GDPR is the EU regulation governing how personal data is handled. We help you understand your obligations, put the right controls and records in place, and demonstrate accountability.
What GDPR is
The General Data Protection Regulation is European Union law that governs the processing of personal data relating to individuals in the EU. It is built on principles such as lawfulness, fairness and transparency, purpose limitation, data minimisation and accountability, and it grants individuals rights over their data including access, rectification and erasure.
The GDPR is a regulation you demonstrate compliance with, not a standard you are certified against. It applies to organisations outside the EU where they offer goods or services to, or monitor, people in the EU. Accountability is central: you are expected to be able to show, through records and documented decisions, that your processing is lawful and that you have appropriate security in place.
The anatomy of the regulation
Article 5 · Principles
Seven principles govern all processing, including lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.
Accountability
The regulation requires you not only to comply but to be able to demonstrate compliance through records, documented decisions and governance.
Article 6 · Lawful bases
Every processing activity must rest on one of six lawful bases, from consent and contract to legal obligation, vital interests, public task and legitimate interests.
Articles 15 to 22 · Data subject rights
Individuals hold rights to be informed, to access, to rectification, to erasure, to restriction, to portability, to object and to protections around automated decisions.
Articles 24 to 32 · Controller and processor duties
Obligations around data protection by design and default, records of processing, processor contracts and appropriate technical and organisational security measures.
Articles 33 and 34 · Breach notification
Personal data breaches must be notified to the supervisory authority, generally within seventy two hours, and to affected individuals where the risk is high.
Article 35 · Data protection impact assessments
High-risk processing requires a documented assessment of the risks to individuals and the measures that address them before processing begins.
Chapter V · International transfers
Transfers of personal data outside the EU must rely on an adequacy decision or safeguards such as standard contractual clauses or binding corporate rules.
Who needs it
- Any organisation that processes personal data of people in the EU, wherever it is based
- SaaS and B2B companies acting as a data processor for EU customers
- Teams expanding into the EU market or handling EU customer or employee data
What you get
- A data mapping exercise and record of processing activities
- Lawful bases, privacy notices, processor contracts and core privacy processes
- Data protection impact assessments where required
- Technical and organisational security measures with penetration test evidence
Timelines depend on the volume and sensitivity of the data you process and your current maturity. We scope it honestly up front rather than promise a fixed number of weeks.
Current version
The GDPR, Regulation (EU) 2016/679, has applied since 25 May 2018 and remains the current law; its text has not been substantially revised since it took effect. What changes more often is the guidance around it, including European Data Protection Board opinions and national supervisory-authority positions, along with the mechanisms for international transfers. There is no new edition to transition to, so staying compliant is a matter of keeping your records, lawful bases and transfer arrangements aligned with current guidance rather than migrating to a new version.
What it costs
The GDPR is a law you demonstrate compliance with, not a standard you are certified against, so there is no certificate to buy and tr3labs is never a certifier, auditor or regulator. The costs are our advisory and implementation fee, quoted up front once we understand your size and starting point, plus any independent input you choose to add, such as an external audit, a specialist legal review or a data protection officer where one is required or useful. Those external parties charge separately on their own schedule and remain independent of us. We will not quote blind; we scope it with you first.
How tr3labs gets you there
Scope and gap assessment
We map your personal data processing, establish your role as controller or processor, build the record of processing activities, and measure your current state against the GDPR's requirements.
Build the controls and records
We help you set lawful bases, update privacy notices and contracts, stand up processes for data subject rights and breach notification, and run data protection impact assessments where needed.
Secure the data
We assess and strengthen the technical and organisational security measures the GDPR expects, and use penetration testing to evidence that personal data is appropriately protected.
Accountability and ongoing support
We assemble the documentation that demonstrates accountability and keep you ready to respond to customers, partners and supervisory authorities.
GDPR or ISO 27701?
Both deal with personal data, so buyers sometimes treat them as the same thing, but one is a law and the other is a certifiable management system that helps you meet it.
| GDPR | ISO 27701 | |
|---|---|---|
| Covers | A legal duty over personal data of people in the EU | A privacy information management system you run and certify |
| Who asks for it | Supervisory authorities, customers and partners | Enterprise buyers and procurement seeking assurance |
| Core idea | Demonstrate lawful, accountable processing | Operate privacy controls that extend ISO 27001 |
| Audit model | No certificate; compliance shown through records and evidence | Two-stage certification by an accredited body, then surveillance |
| Often held with | ISO 27001 and sector privacy rules | ISO 27001 and SOC 2 |
GDPR FAQ
- How much does GDPR compliance cost?
- The GDPR is a law, not a certification, so there is no certificate to buy. You pay our advisory and implementation fee, quoted up front, plus any independent input you choose, such as an external audit, a specialist legal review, or a data protection officer where one is required.
- How long does GDPR compliance take?
- It depends on the volume and sensitivity of the data you process and your current maturity. We scope the timeline honestly up front rather than promise a fixed number of weeks.
- Can you be certified as GDPR compliant?
- The GDPR is a regulation you demonstrate compliance with rather than a standard an accredited body certifies you against. Approved certification mechanisms exist in principle, but in practice organisations evidence compliance through records, documented decisions and appropriate security. We help you build and maintain that evidence.
- Does the GDPR apply to us if we are not in the EU?
- It can. The GDPR applies to organisations outside the EU where they offer goods or services to, or monitor the behaviour of, individuals in the EU. We help you work out whether and how it applies during scoping.
- What is the difference between a controller and a processor?
- A controller decides why and how personal data is processed, while a processor acts on the controller's instructions. Your obligations differ by role, so establishing which you are, and for which data, is one of the first things we do.
The services that get you there
Related standards
Related reading
India's DPDP Act: A Practical Compliance Guide (2025)
What India's Digital Personal Data Protection (DPDP) Act requires, who counts as a data fiduciary, what the 2025 Rules add, the penalties, and a practical path to compliance.
9 min read
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read
How to Read a Penetration Test (VAPT) Report: A Plain-English Guide for Teams
A practical walkthrough of what goes into a penetration test report, section by section, so founders and engineering teams can read one with confidence and act on what it says.
8 min read