Question 1

What is GDPR and who does it apply to?

Accepted Answer

The General Data Protection Regulation (GDPR, Regulation 2016/679) is the EU data protection law that governs how organisations collect, process, store, and transfer personal data of individuals in the European Economic Area (EEA). It applies to any organisation that processes personal data of EU residents, regardless of where the organisation is located. This includes EU-based companies, non-EU companies offering goods or services to EU residents, and organisations monitoring the behaviour of EU residents. GDPR establishes rights for data subjects, obligations for data controllers and processors, and enforcement mechanisms with fines of up to 20 million euros or 4% of global annual turnover.

Question 2

What is a Record of Processing Activities (ROPA) under Article 30?

Accepted Answer

GDPR Article 30 requires both data controllers and data processors to maintain a written Record of Processing Activities (ROPA). For controllers, this must include the name and contact details of the controller, the purposes of processing, categories of data subjects and personal data, categories of recipients, international transfers including safeguards, retention periods, and a general description of technical and organisational security measures. For processors, the record must include the name of each controller on behalf of whom processing is carried out, categories of processing, international transfers, and security measures. Venvera maintains your ROPA automatically as you document processing activities, with export capabilities for supervisory authority requests.

Question 3

What is a Data Protection Impact Assessment (DPIA)?

Accepted Answer

A Data Protection Impact Assessment (DPIA), required under GDPR Article 35, is a process to identify and minimise data protection risks of a project or processing activity. DPIAs are mandatory when processing is likely to result in a high risk to individuals, including systematic and extensive profiling with significant effects, large-scale processing of special categories of data, and systematic monitoring of publicly accessible areas. A DPIA must describe the processing operations, assess necessity and proportionality, evaluate risks to data subjects, and identify measures to address those risks. If the DPIA indicates high residual risk, the controller must consult the supervisory authority under Article 36. Venvera provides structured DPIA templates with risk scoring and mitigation tracking.

Question 4

What is the 72-hour breach notification requirement?

Accepted Answer

GDPR Article 33 requires data controllers to notify their supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. The notification must include the nature of the breach, categories and approximate number of data subjects and records affected, the name and contact details of the DPO, the likely consequences, and the measures taken or proposed to address the breach. If notification is not possible within 72 hours, reasons for the delay must be provided. Where the breach is likely to result in a high risk to individuals, Article 34 requires the controller to also communicate the breach to the affected data subjects without undue delay.

Question 5

How does GDPR handle cross-border data transfers?

Accepted Answer

GDPR restricts transfers of personal data to countries outside the EEA unless adequate protection is ensured. Transfer mechanisms include adequacy decisions by the European Commission (where a third country is deemed to provide adequate protection), Standard Contractual Clauses (SCCs) adopted by the Commission, Binding Corporate Rules (BCRs) approved by supervisory authorities, and derogations for specific situations under Article 49. Following the Schrems II ruling, organisations must also conduct Transfer Impact Assessments (TIAs) to evaluate whether the laws of the recipient country provide essentially equivalent protection. Venvera tracks all cross-border transfers, documents the legal basis for each, and flags transfers to countries without adequacy decisions for TIA completion.

Question 6

What are data subject rights under GDPR?

Accepted Answer

GDPR grants data subjects eight key rights: the right to be informed (Articles 13-14) about how their data is processed, the right of access (Article 15) to obtain a copy of their personal data, the right to rectification (Article 16) of inaccurate data, the right to erasure or "right to be forgotten" (Article 17), the right to restrict processing (Article 18), the right to data portability (Article 20) in a machine-readable format, the right to object (Article 21) to processing based on legitimate interests or direct marketing, and the right not to be subject to automated decision-making including profiling (Article 22). Controllers must respond to data subject requests within one month, extendable by two months for complex requests. Venvera helps you track and manage data subject requests with deadline monitoring.

Question 7

What are the penalties for GDPR non-compliance?

Accepted Answer

GDPR establishes a two-tier penalty structure. The lower tier (Article 83(4)) applies to infringements of obligations on controllers, processors, certification bodies, and monitoring bodies, with fines of up to 10 million euros or 2% of total worldwide annual turnover, whichever is higher. The upper tier (Article 83(5)) applies to infringements of basic processing principles, conditions for consent, data subject rights, and international transfer provisions, with fines of up to 20 million euros or 4% of total worldwide annual turnover, whichever is higher. Supervisory authorities consider factors including the nature, gravity, and duration of the infringement, whether it was intentional or negligent, measures taken to mitigate damage, prior infringements, and the degree of cooperation with the authority.

Question 8

Is there compliance software for GDPR?

Accepted Answer

Yes. Venvera is GDPR compliance software covering your Record of Processing Activities, DPIAs, breach notification and data-subject request handling. It gives you a scoped control set, a gap assessment that scores your readiness against the Regulation, and an evidence workspace behind every Article. Because it maps controls across frameworks, the evidence you already hold for ISO 27001 pre-populates much of your GDPR posture. Start with a free compliance check before you commit.

Domain	NIST SP 800-53	GDPR
Encryption	SC-13Cryptographic Protection SC-28Protection of Information at Rest SC-8Transmission Confidentiality and Integrity	Art. 32(1)(a)Are pseudonymisation and encryption of personal data used where appropriate?
Key Management	SC-12Cryptographic Key Establishment and Management	Art. 32(1)(a)Are pseudonymisation and encryption of personal data used where appropriate?
Access Control	AC-3Access Enforcement AC-6Least Privilege	Art. 32(4)Are persons authorised to process personal data committed to confidentiality or under an appropriate statutory obligation?
Incident Management	IR-4Incident Handling	Art. 33(1)Does the organization have a process to detect, report and investigate personal data breaches?
Incident Reporting	IR-6Incident Reporting	Art. 33(1)Can the organization notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it?
Business Continuity	CP-2Contingency Plan	Art. 32(1)(c)Does the organization have the ability to restore the availability and access to personal data in a timely manner in the event of an incident?
Supplier Contracts	SR-5Acquisition Strategies, Tools, and Methods PS-7External Personnel Security	Art. 28Are written contracts or legal acts in place with all data processors, containing the mandatory Article 28 provisions?
Data Classification	MP-4Media Storage	Art. 5(1)(c)Is personal data adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed?
Security Testing	SA-11Developer Testing and Evaluation CA-2Control Assessments	Art. 32(1)(d)Is there a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational security measures?
Breach Notification	IR-6Incident Reporting SR-8Notification Agreements	Art. 33(1)Can the organization notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it? Art. 34(1)Does the organization have a process to communicate a breach to affected data subjects without undue delay when there is a high risk to their rights and freedoms?
Data Protection Impact Assessment	RA-8Privacy Impact Assessments	Art. 35(1)Does the organization carry out a DPIA where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons?

Compliance operations

Risk & incidents

Intelligence & reporting

EU financial

Privacy & security

Regional

By industry

By role

Learn

Free tools & offers

GDPR fines reach 4% of global turnover.

How much of GDPR do you already have?

GDPR compliance software for the register, the DPIAs and the clock

What is GDPR, and why can you not ignore it?

Your Article 30 register, always current.

Breach notification that beats the 72-hour clock.

DPIAs that surface high-risk processing before it ships.

Every cross-border transfer, with its legal basis on file.

Data-subject requests answered inside the one-month clock.

Every data-protection policy, versioned and acknowledged.

The spreadsheet or Venvera.

GDPR, answered.

Prove your GDPR posture before the regulator tests it.