Compliance walkthrough
How to comply with GDPR: video walkthrough
A walkthrough of building a GDPR compliance programme: decisions, documents and controls that let you demonstrate compliance to a regulator, a customer's auditor or the people whose data you process.
Key takeaways
- The GDPR is a law; there is no GDPR certificate, and compliance must be demonstrable.
- Organisations outside the EU are caught when they offer goods or services to, or monitor, people in the EU.
- Every processing activity needs a lawful basis, recorded with the reasoning behind it.
- Processor agreements, notices, retention rules and DPIAs are part of the evidence.
- Regulators and customers' auditors judge the result; legal interpretation stays with your lawyers.
There is no GDPR certificate: compliance is demonstrated
The General Data Protection Regulation is the European Union's personal data law. It sets principles for every use of personal data, gives individuals enforceable rights, assigns duties to controllers and processors, restricts transfers out of the EU and is enforced by supervisory authorities. It reaches organisations outside Europe as soon as they offer goods or services to people in the EU or monitor their behaviour there.
There is no GDPR certificate to obtain. Compliance is a state you must be able to demonstrate: the controller is responsible for showing that the principles are met. A working programme is therefore a set of decisions, documents and controls with evidence behind them. This short film walks through how that programme is built.
Building the programme, step by step
Define what the programme needs to cover: the entities, countries and sites, your role as controller or processor for each activity, whether the Regulation reaches you from outside the EU, whether a representative or a data protection officer is required, and who will judge the result. A gap analysis then inventories processing activities, systems and data flows, tests notices, contracts, controls and procedures against each obligation, and agrees actions, owners and dates.
Implementation means deciding the lawful basis for each activity, writing the notices and policies, signing processor agreements, putting retention, access and security controls into use, completing the data protection impact assessments that are due and training the people who handle data, recording it as it happens. An internal audit against the Regulation and a management review with the data protection officer or privacy lead show what remains. Whether the programme is enough is judged by the supervisory authority and your customers' auditors; legal interpretation stays with your legal advisers.
Sterling's expert and experienced consultants design and implement the programme with your legal, technology and operations teams under Sterling OS™.
GDPR at a glance
- Purpose
- Data protection: personal data processed lawfully, transparently and securely, the rights of the people it concerns honoured, and the evidence to prove it
- Relevant to
- Any organisation established in the EU or EEA, and any organisation elsewhere that offers goods or services to people in the EU or monitors their behaviour, as controller or processor
- Edition
- Regulation (EU) 2016/679, in application since 25 May 2018; in the United Kingdom the UK GDPR applies alongside the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025
- Certification
- None exists for the GDPR as such. Compliance is assessed by regulators and your customers' auditors; voluntary Article 42 seals are few and never reduce your own responsibility
- Sterling's role
- Programme design and consulting with your team, Effivity, training, internal audit and review readiness, then Sustain™
- Cost and timing
- Total investment for a GDPR compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 8 months
GDPR: questions people ask
Is there such a thing as GDPR certification?
Not in the way ISO certification exists. Article 42 allows voluntary certification, issued by bodies accredited under Article 43 against criteria approved by a supervisory authority or the European Data Protection Board; the Board's register lists only a handful of approved mechanisms, Europrivacy among them, and Article 42(4) says certification does not reduce the controller's or processor's responsibility. A "GDPR certificate" from outside that register is a badge, not a certification.
Does ISO/IEC 27701 or ISO/IEC 27001 make us GDPR compliant?
No standard does. ISO/IEC 27701 is a certifiable privacy management system standard that maps closely to the GDPR's obligations, and ISO/IEC 27001 evidences the security Article 32 asks for; both are strong evidence of a managed programme. Neither is an Article 42 certification, and neither replaces the legal analysis of your lawful bases, notices, contracts and transfers.
We are outside the EU. Does the GDPR really apply to us?
If you offer goods or services to people in the EU, paid or free, or monitor their behaviour there, Article 3(2) applies wherever you are, and Article 27 usually requires a representative in the Union. If you process personal data for an EU client as a processor, your obligations arrive through the Regulation and the Article 28 contract the client must sign with you.
Do we need a data protection officer?
Article 37 requires one for public bodies, for organisations whose core activities involve regular and systematic monitoring of individuals on a large scale, and for those whose core activities involve large-scale processing of special-category or criminal-conviction data. Others appoint one voluntarily. Either way, document the decision; the DPO may be an employee or a contractor, acts independently and reports to top management.
What has to happen within 72 hours of a breach?
Article 33 requires the controller to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to individuals; a late notification must explain the delay. Where the risk is high, Article 34 requires affected people to be told without undue delay. Processors notify their controllers, and every breach, reported or not, goes in the register.
Keep exploring
Related to this video
Read next
The complete guide
Everything on GDPR
Start with the GDPR page, or go straight to the guide you need.
On the GDPR page
Guides
More videos: Privacy and data protection
- How to comply with the Philippine Data Privacy ActCompliance walkthrough · 3 min 15 s
- Philippine Data Privacy Act requirements explainedTwo-minute brief · 2 min
- How to comply with India's DPDP Act 2023Compliance walkthrough · 3 min 15 s
- India's DPDP Act 2023 requirements explainedTwo-minute brief · 2 min
- How to comply with Singapore's PDPACompliance walkthrough · 3 min 15 s
- Singapore PDPA requirements explainedTwo-minute brief · 2 min
- How to comply with Saudi Arabia's PDPLCompliance walkthrough · 3 min 15 s
- Saudi PDPL requirements explainedTwo-minute brief · 2 min
- How to comply with the UAE PDPLCompliance walkthrough · 3 min 15 s
Talk to a consultant
Plan your GDPR compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice