Questions organizations ask when customers, contracts or regulators require GDPR compliance: fines, readiness, certification, documenting security measures, processing agreements, international transfers and self-hosting.
What GDPR non-compliance can cost: the two Article 83 fine tiers, how supervisory authorities calculate fines, other corrective powers such as processing bans, compensation claims, and recent fines tied to security failures and automated decisions.
How organizations check whether their systems and evidence would hold up to a customer audit, a complaint or a supervisory authority inquiry: what the GDPR expects to be documented, the deadlines systems must meet, and where regulators keep finding gaps.
Whether a GDPR certification exists and what it is worth: Article 42 certification and the European Data Protection Seal, who may certify, validity periods, the EDPB register, and how certification counts as evidence without replacing compliance.
How to document technical and organizational measures (TOMs) for customers, contracts and regulators: what the GDPR names, the example list in the Commission's contract annexes, where TOMs must appear, and how regulators judge them.
What a GDPR data processing agreement (the Article 28 contract) must contain, using the Commission's standard clauses, sub-processor approval and lists, audit rights, breach notice terms, and what customers check before signing.
Choosing a lawful route for personal data leaving the EEA: deciding whether a flow is a transfer, adequacy and the EU-US Data Privacy Framework status in October 2026, standard contractual clauses with a transfer assessment, binding corporate rules and derogations.
What changes, and what does not, when an organization runs open-source tools on infrastructure it controls instead of SaaS: fewer processors and transfers to manage, but full responsibility for security, rights handling, breach detection and records.
What GDPR compliance costs and why: no mandatory audit or certificate, the documentation and roles that create internal effort, when a DPO or EU representative is a recurring cost, what published estimates exist, and how fine exposure frames the budget.
How to tell whether the GDPR applies: EU establishment, offering goods or services to or monitoring people in the EU, what counts as personal data including online identifiers, anonymous data, the EEA, and when a non-EU company needs an EU representative.
Whether the GDPR requires penetration tests: what Article 32(1)(d) actually says about regular testing, how processors must support customer audits, what regulators have cited after attacks, and how test evidence supports accountability and fine mitigation.
A practical GDPR checklist built from the obligations that need systems and evidence: records of processing, privacy notices, rights request handling within one month, processor contracts, security measures, breach documentation and the 72-hour clock, DPIAs and the DPO decision.
What is changing around the GDPR in 2026 and what is still only proposed: the Omnibus IV record-keeping exemption, the Digital Omnibus breach notification and DPIA list proposals, the cross-border procedural regulation applying from April 2027, and new EDPB templates.
What the GDPR asks of small companies: which duties scale down (the 250-employee record-keeping exemption), which do not (security, rights requests, processor contracts), the EDPB's small business guide, minimum security measures and when a DPO is still mandatory.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.