SkypherVisit Website →
← Back to blog

Avoid €10 million GDPR Fines: EDPB Guidance and Steps for Businesses

September 25, 2026
Avoid €10 million GDPR Fines: EDPB Guidance and Steps for Businesses

The GDPR, formally Regulation (EU) 2016/679, is the European Union law protecting personal data. It applies to any organization, anywhere in the world, that processes personal data of people in the European Economic Area when offering goods or services or monitoring their behavior. This guide walks through the regulation's principles, rights, obligations, transfer rules, and enforcement mechanisms with links to the primary legal texts you'll want for reference.

TL;DR:

  • GDPR applies to any organization offering goods or services, or monitoring behavior, of individuals in the EEA, regardless of the company's location.
  • The regulation mandates data processing based on specific lawful bases, with consent and legitimate interests being the most common, while requiring detailed documentation.
  • Organizations must maintain a living record of processing activities, appoint DPOs if necessary, and implement data protection by design and DPIAs for high-risk processing.
  • Transfer of personal data outside the EEA requires verification of adequacy, use of standard contractual clauses, or binding corporate rules, accompanied by thorough documentation.
Skypher
Respond to Security Reviews Faster
Skypher helps teams automate security questionnaires with AI, integrations, and collaboration tools for more efficient compliance communication.
Explore Skypher

Table of Contents

A regulation, unlike a directive, applies directly across every EU member state without needing separate national legislation to transpose it. That's precisely what makes GDPR different from its predecessor, the 1995 Data Protection Directive, which left member states to write their own implementing laws and produced a patchwork of inconsistent rules.

The European Parliament and Council adopted the GDPR in April 2016. It entered into force shortly after, but lawmakers built in a two-year runway before enforcement began. The regulation has applied in every EU member state since May 25, 2018, giving organizations time to update contracts, systems, and internal policies before the compliance deadline hit.

Three goals drove the legislation. First, protect the fundamental right to data protection that EU citizens hold under the Charter of Fundamental Rights. Second, harmonize data protection law across the bloc so a company operating in Germany and Poland faces one rulebook, not two. Third, enable the free flow of personal data within the EU's single market, since businesses can't function across borders if each country demands different safeguards.

GDPR doesn't operate alone. A few companion instruments round out the EU's data protection framework:

  • The Law Enforcement Directive (LED) governs how police and criminal justice authorities process personal data, a scenario GDPR itself excludes.
  • EUDPR (Regulation 2018/1725) applies the same core principles to EU institutions and bodies, like the European Commission and Europol.
  • National supervisory authorities, one per member state, enforce GDPR domestically and investigate complaints.
  • The European Data Protection Board (EDPB) coordinates those authorities, issues guidelines, and resolves disputes when regulators disagree.

Understanding this structure matters because GDPR compliance guidelines rarely come from the regulation's text alone. EDPB guidance fills in the operational detail that the legal articles leave abstract, and it's the reference practitioners actually use day to day.

Who Does the GDPR Apply To? Territorial and Material Scope

GDPR distinguishes between two roles. A controller decides why and how personal data gets processed, think of an online retailer deciding to collect email addresses for order confirmations. A processor handles data on the controller's instructions, like a cloud hosting company storing that retailer's customer database. Both carry legal obligations, though controllers bear the heavier burden.

Article 3 sets out territorial scope, and this is where a lot of confusion for GDPR compliance guidelines actually starts. The regulation applies when:

  • An organization has an establishment in the EU, regardless of where the actual data processing happens.
  • A non-EU organization offers goods or services to people in the EEA, even for free, such as a US software company with a European customer base.
  • A non-EU organization monitors the behavior of people located in the EEA, which covers website analytics, ad targeting, and tracking cookies aimed at European visitors.

A Canadian ecommerce site that ships to French customers and accepts euros is offering services to EEA residents. It falls under GDPR even though it has no office in Europe. That's the impact of GDPR reaching well past the continent's borders, and it's why American SaaS companies increasingly build compliance into their product from day one rather than treating it as a European afterthought.

On material scope, GDPR covers automated processing and manual filing systems alike. A spreadsheet of customer names counts if it's organized in a structured, searchable way, not just a database with encryption and access logs. Two exclusions matter: purely personal or household activity (your personal holiday photo album) and processing for national security purposes, which falls outside EU competence entirely.

The Seven Core Principles of GDPR (Article 5) Explained

Every GDPR obligation traces back to seven principles laid out in Article 5. Get these right and most detailed rules follow logically. Get them wrong and no amount of paperwork will save you in an investigation.

  1. Lawfulness, fairness, and transparency. Processing needs a valid legal basis, shouldn't mislead the person involved, and requires clear communication about what's happening to their data. A hidden data-sharing clause buried in paragraph 47 of a privacy policy fails this test.
  2. Purpose limitation. Data collected for one stated reason, like processing a purchase, can't quietly get reused for an unrelated purpose, like selling that email list to a third-party advertiser, without a new lawful basis.
  3. Data minimization. Collect only what's necessary. A newsletter signup form that demands a home address is over collecting.
  4. Accuracy. Personal data must be kept correct and current, with reasonable steps to fix or delete anything wrong.
  5. Storage limitation. Data gets kept only as long as needed for its original purpose, then deleted or anonymized.
  6. Integrity and confidentiality. Appropriate security, covering both technical and organizational measures, protects data against unauthorized access or loss.
  7. Accountability. Organizations must not just follow the other six principles but prove they're following them, through documentation, audits, and internal policy.

Accountability is what ties the whole framework together. It's the principle that turns GDPR from a set of good intentions into an enforceable standard, because a regulator doesn't take your word for it. You need records, retention schedules, and evidence trails that demonstrate compliance on demand.

Pro Tip: Keep a simple internal log showing when data retention periods were reviewed and who approved them. Regulators consistently flag storage limitation as the principle organizations document worst, even when they're actually following it.

What Rights Do Individuals Have Under the GDPR?

GDPR data protection isn't just a compliance checklist for businesses. It hands individuals a concrete set of enforceable rights, and controllers must build systems capable of fulfilling them within set timeframes, not just acknowledge them on paper.

  1. Right to be informed. You're entitled to clear information about how your data gets used, collected at the point of collection.
  2. Right of access. You can request a copy of your personal data and details about how it's processed.
  3. Right to rectification. Incorrect or incomplete data must be corrected on request.
  4. Right to erasure (the "right to be forgotten"). You can ask for your data to be deleted when it's no longer needed, consent is withdrawn, or processing was unlawful.
  5. Right to restriction of processing. You can limit how your data is used while a dispute about its accuracy or lawfulness gets resolved.
  6. Right to data portability. You can obtain your data in a structured, machine-readable format and transfer it to another provider.
  7. Right to object. You can object to processing based on legitimate interests or for direct marketing purposes, and marketing objections must be honored automatically.
  8. Rights related to automated decision-making. You can avoid being subject to decisions based solely on automated processing, including profiling, when they produce legal or similarly significant effects, and you can request human review.

Controllers generally must respond to a rights request within a statutory timeframe, with extensions allowed for complex cases, provided the individual is notified of the delay and reason. Responses should come in a format that's accessible and, whenever reasonably possible, matches how the request was made.

If you're preparing a request yourself, keep it specific. Identify which right you're exercising, provide enough detail for the controller to locate your records, and expect them to ask for identity verification, which is a legitimate step, not a stalling tactic, when the data involved is sensitive.

Which Lawful Basis Applies to Your Data Processing?

Article 6 gives organizations six lawful bases for processing personal data, and picking the right one, then documenting why, is one of the most common places GDPR compliance guidelines get overlooked in practice.

  • Consent must be freely given, specific, informed, and unambiguous, with an easy way to withdraw it later. Pre-checked boxes don't count.
  • Contract covers processing necessary to perform an agreement with the individual, like using a shipping address to deliver a purchased product.
  • Legal obligation applies when a law requires the processing, such as retaining payroll records for tax purposes.
  • Vital interests cover situations involving someone's life or safety, common in emergency medical contexts.
  • Public task applies to organizations carrying out official functions, mostly relevant to public authorities.
  • Legitimate interests allow processing when the organization's interest doesn't override the individual's rights, but this requires a documented balancing test, not just an assumption.

Special category data, covering health records, biometric data, sexual orientation, religious belief, and similar sensitive information, needs an additional legal basis under Article 9 on top of the general Article 6 basis. Explicit consent, employment law obligations, or substantial public interest are the most commonly used routes, and healthcare and biometric authentication providers deal with this layer constantly.

The practical fix for most organizations is a lawful basis register, a simple table pairing each processing activity with its chosen basis and a brief justification. Pair that with a consent management tool that timestamps opt-ins and opt-outs, and you've covered the two spots regulators check first during an inquiry.

Illustration of lawful basis and consent tracking

Controller and Processor Obligations: Records, DPOs, and Contracts

GDPR requirements don't stop at picking a lawful basis. Controllers and processors carry ongoing documentation and structural obligations that regulators expect to see evidence of, not just hear described.

  • Records of Processing Activities (ROPA) must list processing purposes, data categories, recipients, retention periods, and security measures. Organizations with fewer than 250 employees get a limited exemption, but it rarely applies once you're processing anything beyond occasional, low-risk data, which covers most modern SaaS businesses.
  • Data Protection Officers (DPOs) are mandatory for public authorities, organizations doing large-scale systematic monitoring, or those processing special category data at scale. A DPO must operate independently, report directly to senior management, and can't be penalized for raising compliance concerns.
  • Processor contracts need specific clauses under Article 28, covering the scope of processing, security obligations, breach notification duties, and rules for engaging subprocessors.
  • Subprocessor chains require the same contractual protections to flow downstream, so a processor's own vendor is bound by equivalent terms.

Smaller organizations often assume the SME exemption covers more than it does. In practice, if you're processing personal data regularly, which nearly every SaaS product does, you likely need full ROPA documentation regardless of headcount.

Pro Tip: Version your ROPA the way you version code. When a regulator asks how your processing changed after a product update, a dated history beats a single static document every time. Teams building this into their SaaS operations often lean on structured software compliance workflows to keep records current without manual re-entry each quarter.

What Are Data Protection by Design and DPIA Requirements?

Article 25 requires data protection by design and by default, meaning safeguards get built into a system before processing starts, not patched on afterward. EDPB guidance is explicit that this applies to every controller and demands continual review as the processing, technology, or risk profile changes. It's not a launch checklist item you close out once.

A Data Protection Impact Assessment (DPIA), required under Article 35, kicks in when processing is likely to result in high risk to individuals. Large-scale monitoring, processing special category data at scale, or systematic profiling are the usual triggers. A solid DPIA covers:

  • A description of the processing operation and its purpose.
  • An assessment of necessity and proportionality against that purpose.
  • A risk assessment covering likelihood and severity of harm to individuals.
  • Mitigating measures addressing the risks identified.

Article 32 sets baseline security expectations, though it deliberately avoids prescribing exact technology, leaving room for context-appropriate measures. Common examples include:

  • Encryption of personal data at rest and in transit.
  • Pseudonymization, replacing identifying fields with tokens where the mapping key is stored separately.
  • Role-based access control limiting who can view sensitive records.
  • Regular testing and evaluation of technical safeguards.

Retention deserves the same rigor. Set defined periods per data category, automate deletion or anonymization when those periods expire, and revisit the schedule whenever business processes change. A retention policy that was accurate two product launches ago is a liability now, not a safeguard.

How Do International Data Transfers Work Under GDPR?

Moving personal data outside the EEA triggers a separate layer of rules, and this is where GDPR for businesses operating globally gets genuinely complicated.

  1. Check for an adequacy decision first. The European Commission periodically decides that a non-EEA country provides an essentially equivalent level of protection. Transfers to an adequate country need no extra safeguards, but the list changes over time, so verify current status rather than relying on memory or an old contract template.
  2. Use Standard Contractual Clauses (SCCs) when no adequacy decision exists. These are Commission-approved contract terms binding the data importer to EU-equivalent protections. They're the most widely used transfer mechanism for companies moving data to the United States, India, or other non-adequate jurisdictions.
  3. Consider Binding Corporate Rules (BCRs) for multinational groups transferring data internally across entities in different countries. BCRs require regulatory approval and suit organizations with mature, centralized privacy programs more than smaller companies.
  4. Add supplementary measures where needed. Following the Court of Justice's Schrems II ruling, organizations must assess whether the destination country's laws, particularly surveillance laws, undermine the SCCs' protections, and add technical measures like strong encryption when they do.
  5. Document everything. Keep records of which transfer mechanism applies to each data flow, the assessment behind it, and any supplementary measures adopted. This recordkeeping is exactly what a regulator asks for first if a transfer is ever challenged.

Enforcement, Fines, and Supervisory Authorities

GDPR penalties operate on a two-tier system. Less severe infringements, like failing to maintain proper records, can draw fines up to €10 million or 2% of global annual turnover, whichever is higher. Regulators weigh aggravating and mitigating factors: the duration of the infringement, whether it was intentional, cooperation shown during investigation, and prior compliance history all shift the final number.

Cross-border cases run through the One-Stop-Shop mechanism, where the supervisory authority in the organization's main EU establishment leads the investigation and coordinates with authorities in other affected member states. The EDPB steps in through its consistency mechanism when regulators disagree, and organizations can appeal enforcement decisions through national courts, ultimately reaching the Court of Justice of the EU on questions of interpretation.

If you receive notice of an investigation, a few immediate steps matter more than legal maneuvering:

  • Preserve all relevant records rather than editing or deleting anything related to the inquiry.
  • Loop in your DPO or legal counsel immediately, before responding to the regulator.
  • Respond within the stated deadline, even if that response is a request for more time.
  • Review your own documentation honestly before the regulator does, so you know where the gaps are.

How Do You Exercise Your GDPR Rights as an Individual?

Filing a request is usually more straightforward than people expect. Most organizations of any size publish a privacy policy naming a contact or Data Protection Officer, and that's your starting point.

  • Find the right contact. Check the organization's privacy policy or website footer for a DPO email or dedicated privacy contact address.
  • State your request clearly. Name the specific right you're exercising, whether that's access, erasure, or portability, and provide enough detail (account number, email used, date range) for them to locate your data.
  • Expect an identity check. Controllers can reasonably ask for verification before releasing sensitive personal data, particularly for access or erasure requests.
  • Track the one-month clock. Note the date you submitted the request, since that's when the statutory response window starts running.
  • Escalate if you don't get a response. If the organization ignores your request or refuses without adequate justification, you can file a complaint with your national Data Protection Authority (DPA), or the DPA in the country where the organization is established.

For a complaint to land well, keep a paper trail: your original request, the date sent, any reply received, and screenshots or copies of relevant correspondence. DPAs move faster on complaints backed by clear evidence than on vague accounts of frustration, and most national authorities publish a standard complaint form on their website to structure the submission.

Operationalizing GDPR: From Legal Text to Daily Practice

Turning GDPR requirements into daily habit is where most organizations actually struggle, not in understanding the law itself. A living ROPA, one that updates automatically as systems and vendors change rather than sitting untouched in a shared drive, is the difference between a document that impresses a regulator and one that raises questions.

Certain compliance tasks lend themselves naturally to automation:

  • Version-controlled records of processing activities with timestamped change history.
  • Structured workflows for triggering and documenting DPIAs when a new high-risk process is proposed.
  • Templated, trackable response pipelines for subject access requests, so nothing slips past the one-month deadline.
  • Breach response playbooks that pre-assign roles and notification steps before an incident happens, not during one.

Automation patterns can help security and compliance teams manage security questionnaires and audits that increasingly ask about exactly this kind of GDPR readiness. Prospective enterprise customers routinely want documented evidence of data protection practices before signing a contract, and having that evidence organized in advance saves weeks during due diligence.

Pro Tip: Treat your GDPR documentation the same way you'd treat code meant to be audited: dated, versioned, and traceable to a specific decision maker. It turns a defensive scramble into a five-minute export.

Why GDPR Still Matters: An Editorial Take

Most compliance writing treats GDPR as a burden to survive rather than a structure worth using. That framing misses something. Organizations that embed data protection by design into how they actually build products, rather than bolting privacy notices onto finished features, tend to move faster during due diligence, not slower. Enterprise buyers ask harder security and privacy questions every year, and a company that can produce clean records on demand wins deals a competitor with scattered documentation loses.

Enforcement is also shifting. Regulators have moved past headline fines toward procedural coordination, and the Commission has floated updates to streamline how cross-border cases move through the One-Stop-Shop system, a sign regulators want consistency, not just penalties, to drive behavior.

The organizations that treat accountability as an ongoing habit, not a one-time audit, are the ones that stop dreading the next questionnaire.

— Gaspard

Sources

For anyone who wants the primary material rather than secondhand summaries, start with the consolidated text of Regulation (EU) 2016/679 on EUR-Lex, the definitive legal source. The European Commission's data protection pages explain rights and principles in plain terms, while EDPB guidelines cover technical implementation detail. For UK-specific guidance and complaint procedures, Gov is a reliable starting point, and each national DPA publishes its own complaint forms and adequacy decision updates worth checking directly.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

  • EDPB Guidelines on data protection by design and by default (Article 25)

FAQ

What Is the GDPR Regulation?

The GDPR is Regulation (EU) 2016/679, the EU law setting rules for how organizations collect, use, and protect personal data. It has applied across all EU member states since May 25, 2018, and it reaches non-EU organizations that offer goods or services to, or monitor the behavior of, people in the EEA.

What Are the 7 Main Principles of GDPR?

The seven principles are lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. Accountability requires organizations to document and prove compliance with the other six, not just follow them.

Is GDPR Applicable in the US?

GDPR applies to US organizations when they process personal data of people located in the EEA in connection with offering goods or services, or monitoring their behavior, even without a physical EU presence. A US company with no European customers or website tracking aimed at EU visitors generally falls outside its scope.

What Are the 10 Key Requirements of GDPR?

There's no single official "10 requirements" list, but core obligations include: a valid lawful basis for processing, transparency with individuals, honoring data subject rights, maintaining records of processing activities, appointing a DPO where required, conducting DPIAs for high-risk processing, implementing data protection by design, securing data under Article 32, managing international transfers properly, and reporting breaches to supervisory authorities.