← ComplianceEU regulation

It applies
by where your
users are.

GDPR at a glance
Type
EU regulation, plus UK GDPR post-Brexit
Reach
Extraterritorial — based on data subject location
Certification
No general-purpose certificate under Art. 42
Breach clock
72 hours to notify the supervisory authority
Maximum fine
€20M or 4% of global annual turnover
What it actually is

GDPR, without the sales gloss.

The General Data Protection Regulation governs how personal data of people in the EU is collected, used, stored and shared. UK GDPR mirrors it for the United Kingdom. Critically, it is extraterritorial: a company with no European entity at all is still in scope if it offers goods or services to people in the EU or monitors their behaviour. Plenty of companies discover this during a customer's vendor review.

In practice the regulation resolves into a set of concrete artefacts. Article 30 requires records of processing activities. Every processing activity needs a documented lawful basis — and consent is only one of six, frequently the wrong one. High-risk processing requires a Data Protection Impact Assessment. Moving data outside the EEA requires a valid transfer mechanism, which after Schrems II means Standard Contractual Clauses with a transfer impact assessment behind them, or an adequacy decision.

There is no broad GDPR certificate. Article 42 contemplates certification schemes and a small number of approved ones exist, but there is nothing equivalent to an ISO certificate that a buyer will universally recognise. What buyers actually accept is a documented programme and, increasingly, an ISO 27001 or SOC 2 report alongside it.

When you need it

Any one of these is enough.

  • You have EU or UK users, customers or employees — including remote staff
  • A customer sent a Data Processing Agreement you were not ready to sign
  • You are transferring personal data out of the EEA and are unsure on what basis
  • You received a data subject access request and had no process for it
  • You are launching in Europe and want this right before, not after
How long it takes

The route to GDPR.

Typical spans for a company starting from a normal engineering baseline. Your scoping call replaces these with real dates.

Weeks 1–3
Data mapping
Every processing activity, system, purpose, retention period and sub-processor, documented.
Weeks 3–5
Lawful basis & gaps
A defensible lawful basis per activity, notices rewritten, consent mechanics fixed where consent is genuinely the right basis.
Weeks 5–10
Build the programme
ROPA, DPIAs, DPAs, retention schedules, transfer mechanisms, and a DSAR process that meets the deadline.
Weeks 10–14
Operationalise
Staff trained, breach procedure rehearsed against the 72-hour clock, sub-processors papered.
Ongoing
Run it
Outsourced DPO, DSARs handled, new processing assessed before launch rather than after.
What lands in your hands

Deliverables, not a slide deck.

Record of processing (Art. 30)

The document a supervisory authority asks for first. Maintained, not a one-off.

Lawful basis register

Every activity mapped to a basis that holds up, with the reasoning written down.

DPIA framework & completed DPIAs

For the high-risk processing you are already doing, and a process for the next one.

Transfer mechanisms

SCCs, transfer impact assessments and adequacy analysis for every export out of the EEA.

DSAR runbook

Identity verification, search, redaction and response inside the statutory deadline.

DPO support

We hold the role as your outsourced Data Protection Officer, or support the person who does.

Packages

Three ways in.

Readiness
Scoped on the call
one-off

You need to know exactly how far you are, and what it will cost to close the gap.

  • Scoping workshop — systems, people and data in scope
  • Gap assessment against every applicable control
  • Written policy pack, tailored, not templated
  • Evidence map: what to collect, from where, how often
  • Remediation plan with owners and dates
  • Readout with your leadership team
Talk it through
Certification
Most chosen
Scoped on the call
to report

You have a deal, a customer or a board deadline and you need the report in hand.

  • Everything in Readiness
  • Hands-on control implementation with your engineers
  • Evidence collection run by us, not homework for your team
  • Auditor selection from our partner panel, plus fee negotiation
  • We sit in the audit and answer the auditor's questions
  • Findings triaged and closed through to clean report
Start here
Managed
$3,000
from · per month

You are certified and you want to stay that way without hiring a compliance team.

  • Everything in Certification
  • Continuous control monitoring and evidence capture
  • Annual surveillance audits and re-certification managed end to end
  • Vendor and sub-processor risk reviews
  • Security questionnaires and customer due-diligence answered for you
  • Named compliance lead on your Slack
Talk it through

Every engagement is quoted as two separate numbers: our fee, and the external auditor's fee. We negotiate theirs on your behalf and never bundle the two into one price.

GDPR questions

Straight answers.

We are not in Europe. Does GDPR apply to us?
Possibly, and this catches people out. GDPR applies based on where the data subjects are, not where your company is. If you offer goods or services to people in the EU, or monitor their behaviour — which includes a lot of ordinary analytics — you are in scope regardless of incorporation. A twenty-minute scoping call will settle it definitively for your situation.
Can we get GDPR certified?
Not in the way people mean. Article 42 allows for approved certification mechanisms and a few exist, but there is no universal GDPR certificate a buyer will recognise the way they recognise ISO 27001. What actually satisfies customers is a documented programme you can evidence — and many companies pair it with ISO 27001, which does carry a recognised certificate.
Do we need a Data Protection Officer?
A DPO is mandatory if you are a public authority, if your core activities require large-scale systematic monitoring, or if you process special category data at scale. Many companies fall outside those tests and still appoint one voluntarily because customers ask who is accountable. We can hold the role as an outsourced DPO or support your internal appointee.
What is the deadline on a data subject access request?
One month from receipt, extendable by two further months for complex or numerous requests — but you have to tell the individual you are extending, and why, inside the original month. Most organisations miss this not through unwillingness but because nobody owns the process. That runbook is part of what we build.
How does GDPR sit alongside SOC 2 and ISO 27001?
GDPR is law about personal data; the other two are about security programmes. The security controls overlap substantially, so running them together is efficient. ISO 27001 in particular pairs well, because its management-system discipline gives your GDPR programme somewhere to live rather than existing as a folder of documents.
Often needed alongside

Rarely just one framework.

Attestation report

SOC 2

The report North American enterprise buyers ask for before they sign. Type I proves your controls are designed right; Type II proves they actually ran.

SaaS and B2B software selling into US enterprise
SOC 2 in detailCertification

ISO 27001

The international standard for running an information security management system. The certificate European and global enterprise buyers recognise on sight.

Companies selling internationally, especially into Europe
ISO 27001 in detailUS regulation

HIPAA

US law governing protected health information. There is no official HIPAA certificate — there is a compliance programme, and independent validation of it.

Health tech, and any vendor touching US patient data
HIPAA in detail

Get GDPR scoped properly.

Thirty minutes, a founder on the line, and an honest read on scope, sequence and the date you can realistically promise your customer.

Book a scoping callcontact@binaryvlue.com