GDPR Guide: how to achieve compliance?

What is GDPR, in practical terms?

The General Data Protection Regulation is the European reference text on privacy, applicable since 25 May 2018. It governs the "processing" — that is, any operation: collection, recording, consultation, modification, storage, transmission, erasure — of "personal data", defined very broadly as any information relating to an identified or identifiable natural person.

The notion of personal data is broader than commonly assumed: beyond names and email addresses, it includes an IP address, a customer identifier, a phone number, a vehicle registration plate, geolocation data, a photograph, or an advertising cookie. Certain categories known as "sensitive" (health, opinions, trade union membership, biometric data, sexual orientation, etc.) benefit from enhanced protection and are in principle prohibited from processing, except under strict exceptions.

GDPR distinguishes two central roles. The controller decides the purposes and means of processing: it is the principal. The processor processes on behalf of the controller: a SaaS vendor, a payroll provider, a hosting provider. Each role carries its own obligations, and the same organisation is often a controller for its own data (HR, customers) and a processor for its clients' data.

The six principles everything must comply with

All GDPR compliance flows from six founding principles (Article 5). Understanding them makes it possible to resolve most real-world situations without being a legal expert.

• Lawfulness, fairness, and transparency: every processing activity rests on a valid legal basis and individuals are clearly informed.
• Purpose limitation: data is collected for a specific purpose and is not reused in an incompatible way.
• Data minimisation: only the data strictly necessary for the purpose is collected.
• Accuracy: data is kept up to date and errors are corrected.
• Storage limitation: data is not retained indefinitely, but for a justified period.
• Integrity and confidentiality: data is protected by appropriate security measures.

To these six principles a seventh, cross-cutting principle is added: accountability. You must be able to demonstrate, with supporting evidence, that you comply with the other six. It is this principle that makes documentation (register, DPIA, policies, procedures) not optional but constitutive of compliance itself.

Who is affected?

All organisations are affected, from independent practices to large groups, as soon as they process personal data relating to individuals in the EU. There is no general exemption threshold: size modulates certain documentary obligations, but never exempts an organisation from adhering to the principles.

GDPR also has extraterritorial reach. A company established outside the EU is subject to it as soon as it offers goods or services to individuals in the Union, or monitors their behaviour (analytics, targeted advertising). In France, the supervisory authority is the CNIL, which cooperates with its European counterparts through the European Data Protection Board.

• Micro-businesses and SMEs: no substantive exemption; the register exemption for organisations with fewer than 250 employees almost never applies in practice (regular, sensitive or high-risk processing activities).
• Sensitive sectors (healthcare, HR, finance, education, transport): heightened vigilance regarding sensitive data, retention periods and security.
• Associations and public bodies: fully subject to GDPR, often with a mandatory DPO.
• Non-EU actors targeting Europeans: subject to GDPR and sometimes required to designate a representative within the Union.

The documents that prove your compliance

Accountability is materialised through a documentary foundation. These documents are not mere formalities: they are the evidence that protects you in the event of an audit, a dispute, or a demanding client request. Here is the minimum foundation to build and maintain.

In the event of an audit, the supervisory authority will first request the records of processing activities: their absence immediately signals a failing compliance programme.

What penalties apply in the event of non-compliance?

The GDPR provides for a two-tier penalty system, applied according to the severity and type of infringement. Beyond fines, corrective measures and reputational risk often carry greater weight, particularly in B2B where compliance has become a purchasing criterion.

The CNIL may also issue proportionate fines for smaller organisations and favour a support-based approach, but serious or persistent infringements remain subject to heavy sanctions.

How to achieve compliance: the 10-step roadmap

This roadmap transforms a vague obligation into a sequenced action plan. Each step produces a documented, enforceable deliverable. You can follow the steps in order, or prioritise steps 1, 3, 5 and 8, which cover the bulk of the risk.

Step 1 — Map your processing activities

Everything starts with an inventory. Identify all data processing activities: HR (payroll, recruitment, access badges), customers, prospects, suppliers, CCTV, cookies and analytics, newsletters, SaaS tools. For each one, record the purpose, the categories of data and data subjects, the recipients, the retention periods and any transfers outside the EU.

This mapping exercise is not a theoretical exercise: it feeds your register and reveals your risks. Data you don't know you hold is data you cannot secure, erase or justify.

• Interview every department (marketing, HR, IT, finance, management).
• List all third-party tools and where their data is hosted.
• Identify sensitive processing activities and those involving minors.

Step 2 — Appoint a lead (DPO or compliance officer)

Designate a compliance owner. A Data Protection Officer (DPO) is mandatory for public authorities, for the regular and large-scale monitoring of individuals, and for the large-scale processing of sensitive data. In all other cases, appointing a compliance lead is strongly recommended.

This lead orchestrates the programme, trains teams, reviews new processing activities and liaises with the supervisory authority. The role can be filled internally or outsourced — a popular option for SMEs that want senior expertise without creating a dedicated position.

• Check whether a DPO is mandatory for your type of activity.
• Ensure the lead has independence, resources and a direct reporting line to management.
• Register the DPO with the supervisory authority once designated.

Step 3 — Establish lawful bases

Every processing activity must rest on one of the six GDPR lawful bases: consent, performance of a contract, legal obligation, protection of vital interests, public interest task, or legitimate interests. The choice is not free: it depends on the purpose and carries consequences (consent can be withdrawn; legitimate interests requires a documented balancing test).

This is one of the most poorly managed areas. Pre-ticking boxes, confusing consent with legitimate interests, or invoking an inappropriate basis undermines the entire processing activity and exposes you to the highest tier of sanctions.

• Assign and document a lawful basis for each processing activity.
• For consent: ensure it is freely given, informed, specific, unambiguous and revocable.
• For legitimate interests: conduct and retain the balancing test.

Step 4 — Inform data subjects

Transparency is an obligation: individuals must know who is processing their data, why, on what basis, for how long, with whom it is shared and what their rights are. This information is delivered through a privacy policy and tailored notices at each collection point (form, contract, email campaign, camera).

Information must be concise, clear and accessible: a copy-pasted policy that does not reflect your actual processing activities is both useless and risky. Adapt the level of detail to the context and link through to complete information where needed.

• Draft a privacy policy that accurately reflects your register.
• Add short notices to every form and user journey.
• Provide specific, enhanced information for minors.

Step 5 — Maintain your register

The record of processing activities is the cornerstone of accountability. It documents, for each processing activity, the information required by Article 30. It is the first document requested by the supervisory authority during an audit, and the management tool that makes your risk areas visible.

A register only has value if it is kept alive: every new processing activity, every new tool, every change must be reflected in it. A static register loses its evidential weight and signals a compliance exercise in name only.

• Maintain, where necessary, a separate register as controller and as processor.
• Link each entry to its lawful basis, retention periods and security measures.
• Establish a standing rule: no new processing activity without a register entry.

Step 6 — Manage the exercise of rights

Individuals hold powerful rights: access, rectification, erasure, restriction, objection, portability, and the right not to be subject to solely automated decision-making. You must be able to respond to every request, free of charge as a rule, within one month (extendable to three for complex requests).

Without a process, requests get lost, deadlines are missed and complaints follow. Set up a clear channel — ideally a dedicated form promoted in your email footers and on your website — and a defined internal workflow to verify identity, track the request and respond on time.

• Create a single entry point for rights requests.
• Formalise a workflow: receipt, identity verification, handling, response.
• Keep a log of all requests received and responses provided.

Step 7 — Assess and mitigate risks (DPIA)

For processing activities likely to result in a high risk — profiling, systematic monitoring, large-scale sensitive data, automated decisions — GDPR requires a Data Protection Impact Assessment (DPIA). It describes the processing activity, verifies its necessity and proportionality, assesses the risks to individuals and defines measures to mitigate them.

The DPIA must be carried out before the processing begins, involve the DPO, and be reviewed whenever the processing changes. If the residual risk remains high despite the measures taken, the supervisory authority must be consulted beforehand.

• Identify processing activities subject to a DPIA using the supervisory authority's criteria and lists.
• Document risks, measures and residual risk.
• Review the DPIA whenever a significant change occurs.

Step 8 — Strengthen technical and organisational security

Security is not optional: it is both a principle (integrity and confidentiality) and an obligation (Article 32). Measures must be proportionate to the risk: encryption, granular access management, strong authentication, tested backups, logging, network segmentation, updates and staff awareness training.

Also prepare for the unexpected: a data breach management procedure that enables you to detect, assess and, where necessary, notify the supervisory authority within 72 hours and inform affected individuals in the event of a high risk. Improvising this response under pressure is not an option.

• Deploy encryption, access controls and MFA for sensitive access points.
• Regularly test your backups and restoration procedures.
• Draft and test your breach notification procedure (72 hours).

Step 9 — Manage processors and international transfers

Your service providers frequently handle your data: they must be governed by clauses that comply with Article 28 (purposes, security, confidentiality, sub-processing, fate of data at end of contract). Identify them, assess their safeguards and incorporate these clauses systematically.

Also verify where data is located. Whenever a flow leaves the EU — US cloud provider, overseas support, non-EU subsidiary — you are carrying out a transfer that requires a valid transfer mechanism (adequacy decision, standard contractual clauses, Data Privacy Framework) and, often, a transfer impact assessment.

• Map your processors and your international data flows.
• Sign compliant data processing agreements with each of them.
• Secure every non-EU transfer with an appropriate mechanism.

Step 10 — Embed a culture of compliance and continuously improve

Compliance fails when it remains one person's responsibility. It succeeds when it becomes a shared reflex: marketing teams think lawful basis before launching a campaign, HR teams think retention periods, IT teams think security by design. Regular training and awareness are therefore essential.

Finally, compliance needs to be actively managed: internal audits, periodic register reviews, incident and request tracking, key indicators. A compliance score, reassessed over time, makes progress tangible and sustains momentum.

• Train and raise awareness across all exposed functions, not just IT.
• Periodically audit the register, contracts and procedures.
• Track a maturity indicator to prioritise your efforts.

Common mistakes to avoid

• Treating compliance as a one-off project: it is a continuous process that must evolve at the pace of the business.
• Copy-pasting a generic privacy policy that does not reflect actual processing activities.
• Overlooking sub-processors and transfers outside the EU — frequent sources of audits and sanctions.
• Confusing consent with legitimate interest, or stacking invalid pre-ticked boxes.
• Neglecting documentation: without it, even a compliant organisation remains legally exposed.
• Reacting in a panic to a breach without a prepared procedure, and missing the 72-hour deadline.
• Reducing GDPR to an IT matter when it also involves management, marketing, HR and legal.

How Data Comply One supports you

Data Comply One centralises all your compliance in a single platform: a processing register guided by pre-filled templates, rights request management via a dedicated module and submission form, breach tracking, a library of clauses and DPIAs, and a compliance score that reflects your progress step by step.

Two modes are available to you: manage your compliance yourself using the software, or outsource it to our experts — a dedicated outsourced DPO — who manage it on your behalf directly on the platform.

The integrated e-learning, hosted by our awareness avatar Daia, brings your teams on board without jargon, while your dedicated DPO and their deputy ensure continuity. The result: living, demonstrable compliance and a clear shared objective — completing your Compliance Pass.

Where do you stand? ·