Guides for software and service companies that process personal data for customers: working out the role, sub-processors, customer audits, outsourced IT and managed services, and selling into the EU from outside it.
What a SaaS vendor acting as processor must have before enterprise customers sign: an Article 28 agreement, a sub-processor list, documented security measures, breach notice to customers, help with rights requests, return or deletion of data, and audit support.
How to work out whether you are a controller, processor or joint controller for each processing activity, with the EDPB's examples, why the label in the contract does not decide it, and what changes when a processor starts deciding purposes.
How processors handle sub-processors under GDPR: specific versus general authorisation, notice and objection periods, flowing down the same obligations, what controllers must be able to name at all times, and transfer checks when a sub-processor sits outside the EEA.
What a processor must allow when customers ask to audit it, how certifications and codes of conduct can show sufficient guarantees, what evidence answers most audit requests, and how controllers scale verification to risk.
GDPR duties for MSPs, hosting and IT service providers that run systems holding customer personal data: processor obligations, security expectations shown by recent fines, remote administration from outside the EEA, and breach notice to every affected customer.
What a company with no EU establishment must do when the GDPR applies through Article 3(2): appoint an EU representative unless exempt, notify breaches in every affected Member State, and choose a transfer mechanism for data flowing back to its home country.
How US companies meet the GDPR in practice: when the EU-US Data Privacy Framework covers transfers and its pending court appeal, standard contractual clauses as the fallback, the EU representative duty, and US government access questions customers raise.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.