Governance Risk and Compliance

GDPR (General Data Protection Regulation)

The General Data Protection Regulation (GDPR) is a comprehensive data privacy law enacted by the European Union that governs how organizations collect, process, store, and protect the personal data of individuals in the EU and European Economic Area. GDPR applies to any organization worldwide that processes EU residents' data, regardless of where the organization is based.

An E.U. regulation governing how organizations handle the personal data of European citizens.

What is GDPR?

The General Data Protection Regulation, or GDPR, is the EU's flagship data privacy law, and arguably the most influential data protection regulation globally. Effective since May 2018, GDPR establishes strict rules about how organizations handle personal data belonging to people in the EU and EEA.

The critical thing for startups to understand: GDPR applies based on whose data you process, not where your company is located. If your SaaS product has a single user in Germany, GDPR applies to you. If your marketing website collects email addresses from visitors in France, GDPR applies. Geographical location of your headquarters is irrelevant.

GDPR is built on seven core principles:

Lawfulness, fairness, and transparency. You need a legal basis for processing personal data (consent, legitimate interest, contractual necessity, etc.) and must be transparent about what you do with it.
Purpose limitation. Collect data for specified, explicit purposes and don't repurpose it without additional justification.
Data minimization. Collect only the data you actually need. No "collect everything, figure out the use later."
Accuracy. Keep personal data accurate and up to date.
Storage limitation. Don't keep data longer than necessary for its stated purpose.
Integrity and confidentiality. Protect personal data with appropriate security measures. This is where GDPR directly connects to your cybersecurity program.
Accountability. Demonstrate compliance. It's not enough to be compliant; you must prove it.

Why GDPR matters for startups

Fines are substantial. GDPR violations can result in fines of up to 4% of global annual revenue or 20 million euros, whichever is higher. While the largest fines have targeted tech giants, enforcement against smaller companies is increasing. In 2024, EU data protection authorities issued over 2 billion euros in total fines.
It's a market access requirement. If you sell to European customers (or plan to), GDPR compliance is table stakes. Enterprise customers in Europe will ask about your GDPR posture during procurement. Not being GDPR-ready effectively locks you out of the EU market.
Breach notification is mandatory. GDPR requires notification to the relevant supervisory authority within 72 hours of discovering a personal data breach. If the breach poses a high risk to individuals, you must also notify the affected data subjects. This tight timeline requires a prepared incident response process.
Data subject rights create operational requirements. EU individuals have rights including access to their data, deletion ("right to be forgotten"), data portability, and the right to object to processing. Your systems need to support these operations, which requires knowing where personal data lives across your infrastructure.
It influenced global privacy law. GDPR set the template for privacy laws worldwide: California's CCPA/CPRA, Brazil's LGPD, and others follow similar principles. Building for GDPR compliance positions you well for other privacy regulations.

GDPR and cybersecurity

GDPR's Article 32 requires "appropriate technical and organizational measures" to protect personal data. While GDPR doesn't prescribe specific security tools, it expects controls proportionate to the risk, including:

Encryption of personal data in transit and at rest.
Access controls ensuring only authorized personnel can access personal data.
Regular security testing (vulnerability scanning, pen testing).
Incident detection and response capabilities to meet the 72-hour notification requirement.
Resilience and recovery to maintain availability of personal data.

This is where your cybersecurity program directly supports GDPR compliance. The same vulnerability management, access controls, and incident response that satisfy SOC 2 also address GDPR's security requirements.

Frequently asked questions

Does GDPR apply to my startup if we're based in the US?

Yes, if you process personal data of EU or EEA residents. GDPR has extraterritorial reach: it applies to any organization offering goods or services to people in the EU or monitoring the behavior of people in the EU, regardless of where the organization is headquartered. If your SaaS product has European users, your website targets European visitors, or your marketing reaches EU audiences, GDPR applies. The key question isn't where your company is incorporated but whose data you handle.

What counts as personal data under GDPR?

GDPR defines personal data broadly as any information relating to an identified or identifiable natural person. This includes obvious identifiers like names, email addresses, phone numbers, and physical addresses. It also includes IP addresses, cookie identifiers, device IDs, location data, online identifiers, and any information that could be combined with other data to identify someone. "Special categories" of data (health, biometric, genetic, racial/ethnic, political, religious data) have even stricter protections. If you're unsure whether something is personal data under GDPR, it probably is.

What's the difference between GDPR and SOC 2?

GDPR is a law that governs how you handle personal data of EU residents. Non-compliance carries legal penalties including fines. SOC 2 is a voluntary audit framework that evaluates your security controls against the AICPA Trust Services Criteria. There's no legal penalty for not having SOC 2, though customers may require it. They're complementary: GDPR tells you what you must do with personal data (legal requirement), while SOC 2 provides a framework for proving your security controls work (market requirement). The security controls that satisfy SOC 2 often address GDPR's Article 32 security requirements as well.

Related terms

Take Fencer for a spin

See what security handled from code to cloud looks like.
Start a free trial in minutes, or book a demo for a guided tour.

Start Securing Free Book a Demo