Which companies must designate a DPO?

A DPO is mandatory for public sector bodies, organisations whose core activities involve large-scale monitoring of data subjects, and those processing special categories of data at large scale.

What is the maximum fine for GDPR non-compliance?

Up to EUR 20M or 4% of global annual revenue, whichever is higher. Supervisory authorities also issue corrective measures (warnings, processing suspension, etc.).

How long do I have to notify a data breach?

You must notify the supervisory authority within 72 hours of becoming aware of the breach, and inform impacted data subjects without undue delay if the risk to their rights is high.

A Data Protection Impact Assessment (DPIA) is required when a processing activity is likely to result in a high risk for data subjects (e.g. systematic monitoring, sensitive data on a large scale).

How long does it take to be GDPR compliant?

It typically takes 3 to 6 months for an SME with Data Comply One, depending on initial maturity. Our methodology speeds up the process while securing each step.

Regulation GDPR

Everything you need to know about GDPR

The General Data Protection Regulation (GDPR) governs the collection and processing of personal data of European citizens. All organisations are concerned, regardless of size. With Data Comply One, simplify your GDPR compliance with an all-in-one solution.

Book a call Discover GDPR software

May 25, 2018

Effective date

EUR 20M

Max fine (or 4% revenue)

27 countries

EU + applicable outside EU

7 principles

core principles

What is the GDPR?

The General Data Protection Regulation (GDPR) is a European text that came into force on May 25, 2018. It governs the collection, use and protection of personal data of anyone living in the European Union.

Examples of protected personal data

First name, last name, email, phone number

Health data and banking details

IP address, cookies, browsing data

HR data (payroll, CV, performance reviews)

Who is concerned by the GDPR?

Any organisation, regardless of size (SMEs, mid-market, associations, public bodies, e-commerce…), is concerned if it processes personal data (customers, prospects, employees, patients, users, etc.). The GDPR also applies to any foreign company processing personal data of European residents.

Private companies (micro, SME, mid-market, large groups)

Public sector and local authorities

Associations and non-profits

Non-EU companies processing European data

Subprocessors and providers (hosting, software, etc.)

Your GDPR obligations

The GDPR imposes on every concerned organisation a set of organisational, legal and technical obligations to guarantee personal data protection.

Keep a register of processing activities (article 30)

Inform people clearly about the use of their data

Respect data subject rights: access, rectification, erasure, opposition, portability

Secure data (technical and organisational measures)

Carry out data protection impact assessments (DPIA) for high-risk processing

Designate a DPO when required by the regulation

Notify data breaches to the supervisory authority within 72 hours

Risks, sanctions and inspections

Non-compliance exposes you to financial, criminal and reputational sanctions. The supervisory authority can carry out inspections (online, on-site, on documents or hearings).

Administrative fines up to EUR 20M or 4% of global annual revenue

Criminal sanctions for individuals responsible

Reputational damage and loss of customer trust

Compensation actions by impacted data subjects

In 2024-2025, supervisory authorities issued over EUR 300M in fines.

Benefits of successful compliance

Beyond avoiding sanctions, GDPR compliance is a real lever for competitiveness, trust and data governance.

Customer & partner trust – essential in B2B

Win more contracts (notably with public sector and large groups)

Reduced security incidents through better data hygiene

Better data governance and improved decision-making

Differentiation from competitors through visible commitment

Simplifiez votre conformité GDPR avec Data Comply One

FAQ GDPR

The GDPR came into force on May 25, 2018 across all 27 EU member states. It also applies to any foreign organisation processing personal data of European residents.