en
ISO 27001 vs GDPR: Overlap, Gaps, and Combined Compliance
ISO 27001 and GDPR overlap on security but diverge on data subject rights, lawful basis, and transfers. Mapping the controls and where ISO 27001 alone is insufficient.
Oct 1, 2026
GDPR
The GDPR Compliance Hub
Expert analysis and practical guides on GDPR compliance, data protection law, DPO obligations, lawful bases, data subject rights, and enforcement. From Article-by-Article breakdowns to implementation checklists.
EU Regulation 2016/679
Lawful BasesDPO ObligationsROPAData Subject RightsCross-border TransfersData Breaches
The GDPR (Regulation 2016/679) has shaped how every organization touching EU residents' data operates since 25 May 2018. Cumulative enforcement passed €5.5 billion by end of 2025, with the largest single fine (€1.2B against Meta) tied to international transfers. Below are deep-dive guides on the principles, obligations, and enforcement priorities that matter in 2026 — ordered by reader frequency.
Start with Article 5: the seven core data privacy principles, including the storage limitation principle, purpose limitation, and accuracy. Move to operational requirements: Article 28 sub-processor obligations, the DPA template, and vendor audit checklist. For international transfers, see our cross-border transfers guide, the SCCs reference, and the Transfer Impact Assessment methodology.
Operating multi-jurisdiction? Compare the BCR vs SCC vs DPF mechanisms, or read our global compliance guide. For Switzerland, the RGPD/nLPD guide and nLPD vs RGPD differences are the right starting points. For DPO functions, see the DPO job description template and certification comparison.
Latest 18 articles
en
GDPR and Outbound Sales: Rules, Controls and a €500,000 Case
Apply GDPR to outbound sales: lead sources, channel rules, notices, objections, CRM data and suppliers, with the Futura judgment explained.
Sep 30, 2026
en
GDPR Compliance Checklist: Verify Your Actual Processing
A practical GDPR checklist for scope, records, lawful basis, transparency, rights, processors, security, breaches, transfers and evidence, with risk-based verification steps.
Sep 30, 2026
en
GDPR Article 13: Privacy Information at Collection
Apply GDPR Article 13: direct collection, notice content, conditional information, layered presentation, new purposes and evidence of transparency.
Sep 30, 2026
en
GDPR Article 25: Put Data Protection into Design and Defaults
What GDPR Article 25 asks controllers to design, configure and document, with practical examples for forms, access, retention and supplier selection.
Sep 30, 2026
en
GDPR Article 32: Choose and Test Security Measures for the Risk
A practical reading of GDPR Article 32: risk assessment, encryption, access, restoration, regular testing, processors and evidence without invented universal controls.
Sep 30, 2026
en
GDPR Article 34: When and How to Tell People About a Breach
Apply GDPR Article 34's high-risk test, clear-language content, timing and three conditional exceptions when communicating a breach to affected people.
Sep 30, 2026
en
GDPR Articles Index: All 99 Articles and How to Use Them
Navigate all 99 GDPR articles by chapter, understand how obligations connect, and find practical guides on principles, rights, security, transfers and remedies.
Sep 30, 2026
en
GDPR Article 24: Controller Responsibility in Practice
Article 24 requires controllers to implement, demonstrate, review and update proportionate GDPR measures. Learn what evidence to keep and how it differs from Articles 25 and 32.
Sep 30, 2026
en
GDPR Article 36: When a DPIA Requires Prior Consultation
Work out when high residual risk calls for GDPR Article 36 consultation, what to submit, how the authority's advice works and what to record.
Sep 30, 2026
en
GDPR Article 83: How Administrative Fines Are Assessed
Understand GDPR Article 83 fine ceilings, case-by-case factors, linked infringements, undertaking turnover and the EDPB's calculation guidance.
Sep 30, 2026
en
Swiss FADP vs GDPR: Breach Reporting and Enforcement
Compare Swiss FADP Article 24 and GDPR Articles 33–34: reporting thresholds, timing, notices to people, authorities and the distinct Swiss criminal-offence rules.
Sep 30, 2026
en
GDPR Article 20 Data Portability: Scope and Requests
GDPR Article 20 explained: provided and observed data, access versus portability, reusable formats, direct transfer, third-party rights and request deadlines.
Sep 30, 2026
en
GDPR Article 33 on EUR-Lex: When and How to Notify a Breach
Read GDPR Article 33 accurately: awareness, the 72-hour authority notification, risk threshold, phased information and breach documentation.
Sep 30, 2026
en
GDPR Article 39: The DPO's Five Tasks Explained
Article 39 gives a data protection officer five listed tasks and a risk-based approach. Learn what the DPO advises, monitors and handles with the authority.
Sep 30, 2026
en
GDPR Article 5 Storage Limitation: Official Rule Explained
Read GDPR Article 5(1)(e): purpose-based retention, legal obligations, Article 89 safeguards, anonymisation, backups, records and erasure requests.
Sep 30, 2026
en
GDPR Purpose Limitation and Data Minimisation: Official Rules in Practice
Use GDPR Articles 5(1)(b), 5(1)(c), 6(4) and 89 to define purposes, justify fields and assess a proposed reuse of personal data.
Sep 30, 2026
en
GDPR Data Minimisation and Storage Limitation in Practice
Apply GDPR data minimisation and storage limitation together: necessary fields, access, retention stages, copies, backups, suppliers and individual rights.
Sep 30, 2026