GDPR Compliance
Adherence to the EU's General Data Protection Regulation, governing how organizations collect, store, process, and transfer personal data of EU residents.
GDPR (General Data Protection Regulation) compliance refers to the organizational, legal, and technical measures implemented to meet the requirements of EU Regulation 2016/679, which governs how organizations collect, process, store, and transfer the personal data of individuals in the European Union and European Economic Area. Effective May 25, 2018, GDPR applies to any organization worldwide that processes personal data of EU residents — regardless of where the organization is based.
GDPR establishes eight fundamental individual rights: the right to be informed, right of access, right to rectification, right to erasure ('right to be forgotten'), right to restrict processing, right to data portability, right to object, and rights related to automated decision-making and profiling.
Key compliance obligations for organizations include: lawful basis for processing (consent, legitimate interest, contract performance, legal obligation, vital interests, or public task); privacy by design and default (embedding data protection into system and process design from the start); data protection impact assessments (DPIAs) for high-risk processing activities; appointment of a Data Protection Officer (DPO) for required organizations; breach notification within 72 hours of discovery; and maintaining records of processing activities.
In the financial services context, GDPR interacts with sector-specific regulations (PSD2, AML KYC requirements). Financial institutions often face tension between GDPR data minimization principles and AML/KYC obligations to retain customer data. Legitimate interest and legal obligation bases typically apply to AML data retention.
Fines for GDPR violations are severe: up to €20 million or 4% of global annual revenue (whichever is higher) for the most serious violations. Major enforcement actions include CNIL fining Google €150 million, Luxembourg fining Amazon €746 million, and Ireland fining Meta €1.2 billion.
FAQs
Does GDPR apply to US companies?
Yes, if the US company processes personal data of EU/EEA residents — whether by offering goods/services to them or by monitoring their behavior. This applies to virtually any SaaS company, ecommerce site, or digital service with EU users, regardless of whether the company has any physical presence in Europe. US companies must comply with GDPR or risk enforcement action from EU data protection authorities.
What is a Standard Contractual Clause (SCC) and why is it important?
SCCs are legal contracts pre-approved by the European Commission that provide a legal basis for transferring personal data from the EU to countries without an adequacy decision (including the US after the Schrems II ruling invalidated Privacy Shield). B2B SaaS companies must execute SCCs with EU customers and with their sub-processors handling EU data. Post-Schrems II, SCCs must be supplemented by transfer impact assessments.
What is the right to erasure under GDPR?
The right to erasure (Article 17) requires organizations to delete an individual's personal data upon request when it's no longer necessary for the original purpose, consent is withdrawn (and no other legal basis applies), or the data has been unlawfully processed. However, it doesn't apply when data must be retained for legal obligations — financial transaction records often must be retained 5–7 years under AML and tax law, overriding erasure requests.
Related Terms
AML
Anti-Money Laundering — a framework of laws, regulations, and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income.
KYC
Know Your Customer — the process of verifying the identity of customers and assessing their risk profile to prevent fraud, money laundering, and terrorist financing.
SOC 2
A security audit standard developed by the AICPA assessing a service company's data security, availability, processing integrity, confidentiality, and privacy controls.
PCI DSS
The Payment Card Industry Data Security Standard — a set of security requirements for organizations that handle cardholder data, mandated by card networks.
