What GDPR Covers
GDPR applies to any organisation that processes personal data of individuals located in the EU/EEA, regardless of where the organisation is established. Core obligations include: identifying a lawful basis for processing (Article 6), fulfilling data subject rights (Articles 15-22), implementing appropriate technical and organisational measures (Article 32), conducting Data Protection Impact Assessments for high-risk processing (Article 35), and appointing a Data Protection Officer where required (Article 37).
Who Must Comply
The following entities are subject to GDPR Compliance Hub obligations:
- →Any organisation processing EU/EEA resident data
- →Data processors acting on behalf of EU controllers
- →Organisations monitoring EU resident behaviour online
- →Businesses offering goods/services to EU residents
- →Organisations transferring EU data to third countries
- →Healthcare providers, financial institutions, and tech companies with EU users
Penalties and Enforcement History
GDPR penalties operate on two tracks under Article 83. Lower-tier violations (Art. 83.4) — including security breach notification failures and processor obligations — carry fines up to €10M or 2% of global annual turnover. Upper-tier violations (Art. 83.5) — including unlawful processing and data subject rights infringements — carry fines up to €20M or 4% of global turnover.
Enforcement Timeline
Regulatory Comparison
| Dimension | GDPR | CCPA (US) | PDPA (Thailand) |
|---|---|---|---|
| Applicability | EU/EEA data subjects globally | California residents | Thailand data subjects |
| Max Fine | €20M or 4% turnover | $7,500 per intentional violation | THB 5M (~€140K) |
| Enforcement Body | National DPAs + EDPB | California AG + CPPA | Office of PDPC |
| Compliance Timeline | Since May 2018 | Since Jan 2020 | Since Jun 2022 |
| DPO Requirement | Mandatory in 3 scenarios | No equivalent | No equivalent |
Mitigation Strategy
Map all personal data flows and document processing activities in your Article 30 Record of Processing Activities (RoPA). Identify the lawful basis for each processing purpose. Review existing consent mechanisms for compliance with Article 7 requirements.
Assess whether your organisation meets any of the three DPO mandate triggers under Article 37. If required, appoint a qualified DPO and register their contact details with the lead supervisory authority. Ensure operational independence under Article 38.
For transfers to non-adequate third countries (including the U.S. absent Privacy Shield successor), implement Standard Contractual Clauses (SCCs) with Transfer Impact Assessments (TIAs). Document supplementary measures where required by Schrems II analysis.
Frequently Asked Questions
A: Yes. Article 3(2) GDPR applies to controllers and processors not established in the EU where processing activities relate to offering goods or services to EU/EEA data subjects, or monitoring their behaviour. U.S. companies serving EU customers are subject to full GDPR compliance obligations and must appoint an EU representative under Article 27.
A: Article 33 requires notification to the competent supervisory authority within 72 hours of becoming aware of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals. Higher-risk breaches additionally require notification to affected data subjects under Article 34. Not all breaches require notification — low-risk incidents may be documented internally only.
A: Yes. Article 7(3) GDPR provides that data subjects may withdraw consent at any time, and withdrawal must be as easy as giving consent. Processing carried out before withdrawal remains lawful, but processing on the basis of withdrawn consent must cease. Organisations relying solely on consent as the lawful basis must implement robust withdrawal mechanisms.