GDPR
US law · Varies · ongoing
- Controls
- EU regulation; data-subject rights and lawful-basis duties
- Recertification
- No certificate; ongoing legal obligation
- Oversight
- EU data protection authorities
- Common gaps
- DPAs, records of processing, data-subject request handling
- Related
- SOC 2 (Privacy criteria), ISO 27001
- Public registry
- EUR-Lex ↗
What is GDPR?
The General Data Protection Regulation is the EU's data-protection law. It governs how personal data of EU residents is collected and processed, with significant penalties for non-compliance.
Is GDPR a certification or an attestation?
GDPR is a regulation, not a certification. SOC 2's optional Privacy criteria can help evidence parts of a privacy program, but the two are not equivalent.
Who needs GDPR?
Any organization processing the personal data of people in the EU, regardless of where the company is based.
What does it cost and how long does it take?
Compliance is an ongoing program rather than a one-off audit; legal counsel typically leads, with security controls supporting.