What is GDPR?
GDPR is the EU regulation governing the personal data of EU and EEA residents. It is built on seven principles and six lawful bases, and imposes operational duties including Records of Processing (Article 30), data subject access requests within one month, Data Protection Impact Assessments (Article 35), and 72-hour breach notification (Article 33). Fines reach €20M or 4% of annual worldwide turnover, whichever is higher.
Who must comply with GDPR?
Any organization that processes the personal data of people in the EU or EEA, regardless of where the organization is based. That includes most SaaS companies and any business with EU customers, users, or employees.
What is a RoPA and a lawful basis?
A Record of Processing Activities (RoPA, Article 30) documents what personal data you process, for what purpose, and where it flows. A lawful basis (Article 6, consent, contract, legitimate interests, and others) is the legal justification you must have and record for each processing activity.
How does Compyl automate GDPR?
Compyl maps where personal data lives, runs DSAR and DPIA workflows, keeps your RoPA current, collects Article 32 security evidence, scores evidence health, and flags drift, so you can prove compliance on demand instead of scrambling for a regulator or a DSAR deadline.
How does Compyl score evidence quality?
Compyl 26.2 introduced Evidence Health, which continuously scores every piece of evidence on relevance, freshness, and completeness, with an AI summary of what is missing, so gaps surface before a regulator or a 72-hour clock, not during.
Can one GDPR control satisfy other frameworks?
Yes. Compyl cross-maps each control so a single control and its evidence can satisfy GDPR alongside SOC 2, ISO 27001, HIPAA, and 70+ other frameworks. Collect once, reuse everywhere it applies.
Who is Compyl’s GDPR solution designed for?
Security, privacy, and GRC teams, CISOs, DPOs, and IT leaders, at any organization that handles the personal data of EU or EEA residents and needs to run GDPR as an operational program, not a static policy.
Has the EU Digital Omnibus changed GDPR?
Not yet. The European Commission’s November 2025 Digital Omnibus proposal would extend breach notification to 96 hours for high-risk breaches only, create a single incident reporting point and narrow the definition of personal data. It is still being negotiated, and the EDPB opposes key parts, so current GDPR obligations still apply.
Is the GDPR breach deadline 72 or 96 hours?
It is 72 hours. Article 33 requires notifying the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to individuals. The 96-hour threshold exists only in the Digital Omnibus proposal.
What is the GDPR Procedural Regulation?
Regulation (EU) 2025/2518 harmonizes how data protection authorities handle cross-border complaints, with common admissibility rules, procedural rights and investigation deadlines. It entered into force on January 1, 2026 and applies from April 2, 2027.
