Skip to main content
OK-GRC

Privacy

GDPR — General Data Protection Regulation (EU) 2016/679

The European regulation governing every processing of personal data, applied in France together with the French Data Protection Act.

Get started with GDPRBook a demo

At a glance

Type
EU regulation, directly applicable
Applicable since
25 May 2018
Authority in France
CNIL
Certification
No general “GDPR certification” for a company

82 requirements tracked · 101 shared controls

What is GDPR?

Regulation (EU) 2016/679, applicable since 25 May 2018, sets the rules for any processing of personal data: collection, use, retention, sharing and transfer. It applies directly in every Member State; in France it is supplemented by the amended Data Protection Act of 6 January 1978 and enforced by the CNIL.

The GDPR is built on accountability: being compliant is not enough, you must be able to demonstrate it with up-to-date documentation (records, impact assessments, policies, contracts) and evidence of the measures taken. Fines can reach €20 million or 4% of worldwide annual turnover.

Key requirements

  1. 1

    Principles and lawful bases

    Specified purposes, data minimisation, accuracy, limited retention and a lawful basis for each processing (contract, legal obligation, legitimate interest, consent…).

  2. 2

    Records of processing activities (Art. 30)

    List each processing: purposes, categories of data subjects and data, recipients, transfers, retention periods and security measures.

  3. 3

    Information and data subject rights

    Inform clearly (Art. 13 and 14) and answer access, rectification, erasure, objection or portability requests, in principle within one month.

  4. 4

    Data protection by design and security

    Build data protection into projects and ensure security appropriate to the risk (Art. 25 and 32).

  5. 5

    Processors and transfers

    Bind every processor with an Art. 28 compliant contract and secure transfers outside the European Economic Area.

  6. 6

    Data protection impact assessment (DPIA)

    For processing likely to result in a high risk (CNIL list, EDPB criteria), assess risks and measures before going live.

  7. 7

    Personal data breaches

    Document every breach, notify the supervisory authority within 72 hours when it poses a risk and inform individuals when the risk is high.

Summary written by OK-GRC. The texts of ISO standards are protected by copyright and are not reproduced.

How OK-GRC helps

  • Complete records of processing (controller and processor) with 43 templates of common processing activities and a completeness indicator
  • Automatic DPIA screening (CNIL list, EDPB criteria) and a step-by-step DPIA wizard
  • Data subject request tracking with computed deadlines, reminders, response templates and an optional public form
  • Breach management with the 72-hour countdown and a decision history
  • Vendors and processors: DPA, location, transfer mechanism, questionnaires
  • The AI assistant suggests lawful bases, privacy notices and draft answers; you validate

Related frameworks

With ISO 27001 controls in place, your GDPR starting score is about 19 to 41%.

The controls you put in place for GDPR also count for:

Frequently asked questions about GDPR

Does a small company need records of processing?

In practice, yes. The exemption for organisations with fewer than 250 people does not apply as soon as processing is not occasional (payroll, customer management…), which is the case for almost every company. The CNIL recommends keeping records in all cases.

Can a company be “GDPR certified”?

There is no general GDPR compliance certification for a company. You can, however, certify a privacy information management system against ISO/IEC 27701, or certify the skills of your DPO.

Does OK-GRC replace a DPO?

No. OK-GRC equips the DPO (records, DPIA, requests, breaches, evidence) and saves time, but the legal analysis and decisions remain those of your organisation and its DPO.

Informational content up to date as of October 2026; it does not constitute legal advice. Always check the official texts in force.

Ready to simplify your compliance?

Create your workspace in minutes. The assistant suggests the frameworks and priorities that fit your company.

Start the free trialBook a demo

14-day trial with every Pro feature · Nothing charged before the trial ends · No commitment