Guide
GDPR Guide: Legal Bases, Documentation, Rights, Breaches and Fines
The GDPR (Regulation (EU) 2016/679) applies to any organisation processing personal data in the EU, and to many outside it. These guides follow the order most companies need: choose a legal basis, document the processing, deal with processors and transfers, handle requests and breaches.
At a glance
| Legal form | Regulation: applies directly in every member state since 25 May 2018 |
| Legal basis | Every processing needs one of six bases in Article 6 |
| Breaches | Notify the authority within 72 hours of becoming aware, unless unlikely to result in a risk |
| Access requests | Answer within one month, extendable by two months for complex requests |
| Fines | Up to €20 million or 4%, or €10 million or 2%, of worldwide turnover, depending on the infringement |
Each point is explained, with its legal source, in the guides below.
Foundations
The Six Lawful Bases Under GDPR Article 6: How to Choose the Right One
Consent, contract, legal obligation, vital interests, public task and legitimate interests: what each requires, how the Court of Justice reads "necessary", and a method to pick and record one basis per purpose.
9 min read
GDPR Special Category Data: The Article 9 Conditions Explained
The categories in Article 9(1), why data can be special by inference, the ten conditions in Article 9(2), why you still need an Article 6 basis, and the DPIA, DPO and record-keeping duties that follow.
9 min read
Legitimate Interest Assessment: The Three-Part Test After EDPB Guidelines 1/2024
The three cumulative conditions, how to articulate the interest, the necessity test, the four-part balancing in the EDPB's guidelines, and what to write down.
10 min read
GDPR for SaaS Startups: The Minimum You Need on Day One
Your two GDPR roles, the six documents customers and investors will ask for, security and breach basics, transfers, and when you need a DPO or an EU representative.
9 min read
Documentation
GDPR Record of Processing Activities (RoPA): What Article 30 Requires
The fields Article 30 requires from controllers and processors, why the 250-employee exemption rarely helps, the pending reform, and a practical way to build the record.
9 min read
What a GDPR Privacy Policy Must Contain: Articles 13 and 14 Checklist
Every item Articles 13 and 14 require, with article references, what changes when you get data from other sources, and how to write it so people actually understand it.
9 min read
GDPR Data Protection Impact Assessment: Step-by-Step Guide
When is a DPIA required, what must it contain, and how to conduct one step by step. Practical guide for GDPR Article 35 compliance.
12 min read
Data Protection by Design and by Default (GDPR Article 25): A Practical Checklist
The two duties in Article 25, the factors that decide what is appropriate, design measures for each GDPR principle following EDPB Guidelines 4/2019, and the defaults product teams should ship.
9 min read
Data Retention Policy: How Long to Keep Personal Data Under GDPR
The storage limitation principle, the four places GDPR expects retention to appear, how to set periods per data category, and how to actually delete or anonymise.
8 min read
Roles and contracts
Data Processing Agreement (GDPR Article 28): Clause-by-Clause Checklist
The details every DPA must describe, the eight processor obligations of Article 28(3), sub-processor rules, the Commission's standard clauses and common gaps.
9 min read
Joint Controllers Under GDPR Article 26: When It Applies and What the Arrangement Needs
The test for joint control, five Court of Justice rulings from fan pages to consent frameworks, how it differs from controller to processor, and what to put in the Article 26 arrangement.
9 min read
Do You Need a Data Protection Officer? GDPR Articles 37 to 39 Explained
The three cases in Article 37(1), how regulators read core activities, large scale and regular and systematic monitoring, national rules, who can be your DPO, and what the role involves.
9 min read
International transfers
Transferring Data to US SaaS: The EU-US Data Privacy Framework Explained
How the 2023 adequacy decision works, why you must check the provider's certification, what the 2025 court ruling means, and what to use when a provider is not certified.
8 min read
Standard Contractual Clauses: Which Module Do You Need?
The four modules of the 2021 standard contractual clauses and how to choose one, the options and annexes you must complete, why the clauses cannot be edited, when they do not apply, and the mistakes that make them ineffective.
9 min read
Transfer Impact Assessment (TIA): How to Do One After Schrems II
When you need a TIA and when you do not, the EDPB's six steps, the elements Clause 14 of the standard contractual clauses requires, supplementary measures that work, and how US transfers changed after the Data Privacy Framework.
10 min read
Rights, cookies and AI
Data Subject Access Requests: How to Respond Within One Month
What a person is entitled to under Article 15, the one-month deadline and extensions, proportionate identity checks, what the copy must contain, and when you can refuse or charge.
9 min read
The Right to Erasure Under GDPR Article 17: When You Must Delete, and When You May Refuse
The six grounds for erasure, the five exceptions, the one-month deadline, telling recipients under Article 19, backups and anonymisation, and the seven problems regulators found in the EDPB's 2025 coordinated action.
9 min read
Cookie Banners: What EU Regulators Actually Check
The ePrivacy consent rule, and the banner practices EU data protection authorities agreed are invalid: no reject button, pre-ticked boxes, deceptive design and fake "essential" cookies.
9 min read
AI Agents and GDPR: Legal Basis, Automated Decisions and DPIAs
Roles, legal basis, Article 22 after the SCHUFA and Dun & Bradstreet rulings, DPIAs, logs and retention, and the checks EDPB Opinion 28/2024 expects before you deploy someone else's model.
10 min read
Breaches and fines
GDPR Breach Notification: The 72-Hour Rule Step by Step
When a breach must be reported, when the 72 hours start, what the notification to the authority must contain, and when you must also tell the people affected.
11 min read
How GDPR Fines Are Calculated: The EDPB Method in Five Steps
The legal maximum, the three seriousness bands, the turnover adjustment for smaller companies and the final checks, with a worked example for a small company.
10 min read
How Much Does a GDPR Data Breach Really Cost? [2026 Data]
Beyond the headline fines — the true cost breakdown of a GDPR breach including legal fees, notification costs, customer churn, and remediation.
10 min read
Top GDPR Fines in 2025-2026: Lessons for Your Business
Analysis of major GDPR enforcement actions — what drives the largest fines, patterns across DPAs, and practical lessons for your compliance strategy.
10 min read
Related articles
Free tools
GDPR Compliance Checklist
48 items across 8 categories.
DPIA Helper
Screen whether processing needs a DPIA.
Privacy Policy Generator
Draft an Article 13 and 14 notice.
Breach Cost Calculator
Estimate a fine range with the EDPB method.
Cookie Consent Checker
23 checks for your banner.
Data Mapping Tool
Map your data flows.
Templates
GDPR Records of Processing (RoPA) Kit · $29.00
Controller and processor RoPA templates, LIA template, data inventory.
Get the templates →Privacy Impact Assessment Bundle · $34.00
DPIA template and screening, transfer impact assessment, DPO consultation record.
Get the templates →GDPR Data Breach Response Toolkit · $29.00
72-hour checklist, impact matrix, breach register, notification letters.
Get the templates →Other guides: NIS2 · DORA · Cyber Resilience Act · AI Act and AI agents · Security for startups and SMEs
This guide is for informational purposes only and does not constitute legal advice. Last updated: October 2026.