en
GDPR Compliance Guide 2026: 10 Obligations, Step by Step
GDPR compliance guide 2026: the 10 obligations in order — lawful basis, ROPA, notices, rights, DPIA, processors, transfers, security, breach, retention.
Jul 30, 2026
GDPR
The GDPR Compliance Hub
Expert analysis and practical guides on GDPR compliance, data protection law, DPO obligations, lawful bases, data subject rights, and enforcement. From Article-by-Article breakdowns to implementation checklists.
EU Regulation 2016/679
Lawful BasesDPO ObligationsROPAData Subject RightsCross-border TransfersData Breaches
The GDPR (Regulation 2016/679) has shaped how every organization touching EU residents' data operates since 25 May 2018. Cumulative enforcement passed €5.5 billion by end of 2025, with the largest single fine (€1.2B against Meta) tied to international transfers. Below are deep-dive guides on the principles, obligations, and enforcement priorities that matter in 2026 — ordered by reader frequency.
Start with Article 5: the seven core data privacy principles, including the storage limitation principle, purpose limitation, and accuracy. Move to operational requirements: Article 28 sub-processor obligations, the DPA template, and vendor audit checklist. For international transfers, see our cross-border transfers guide, the SCCs reference, and the Transfer Impact Assessment methodology.
Operating multi-jurisdiction? Compare the BCR vs SCC vs DPF mechanisms, or read our global compliance guide. For Switzerland, the RGPD/nLPD guide and nLPD vs RGPD differences are the right starting points. For DPO functions, see the DPO job description template and certification comparison.
Latest 18 articles
en
GDPR Consent Examples 2026: 12 Copy-Paste Wording Templates
12 GDPR consent examples: cookie banner, newsletter, marketing, profiling and special category wording, CNIL and AEPD tested, plus the fines you avoid.
Jul 30, 2026
en
Right of Access Under GDPR (Article 15) Explained
Practical guide to GDPR right of access under Article 15 — what individuals can request, what to disclose, and how to respond compliantly.
Jul 30, 2026
en
Opt-In vs Opt-Out: Definitions, GDPR Rules and Examples
Opt-in means ask first; opt-out means stop on request. When GDPR requires each, with a comparison table and examples for email, cookies, calls and data sharing.
Jul 30, 2026
en
GDPR Consent Wording Examples: 8 Templates That Pass
GDPR consent wording examples: 8 copy-ready templates for cookies, newsletters, health data, children and sharing — plus the failures DPAs actually sanction.
Jul 30, 2026
en
GDPR Compliance Framework: the 11 Deliverables, in Order
GDPR compliance framework: the 11 deliverables in build order — ROPA, lawful basis register, DPIA triggers, DPAs, transfer map, breach playbook, audit cycle.
Jul 30, 2026
en
Australia–EU Data Transfers: Adequacy Status and SCCs
Australia has no EU adequacy decision. Which SCC module applies, how to run the transfer impact assessment against Australian government access powers, and the contract path for Australian vendors.
Jul 30, 2026
en
Canada-EU Data Transfers: Adequacy Scope and SCCs
Canada's adequacy decision covers only recipients subject to PIPEDA. What falls outside it — public bodies, non-profits, some employee and health data — and when SCCs are required.
Jul 30, 2026
en
India's DPDP Act 2023 vs GDPR: Key Differences
Consent and legitimate uses against six lawful bases, Consent Managers, the rights India's DPDP Act omits, the Data Protection Board, rupee penalties, and the phased commencement to May 2027.
Jul 30, 2026
en
DPIA for Health Data: When It Is Required and What It Must Contain
Art. 35(3)(b) names large-scale Art. 9 processing, so a health DPIA is rarely optional. The Art. 35(7) content applied to a clinical system, WP248 criteria, Art. 36 prior consultation, and when to redo it.
Jul 30, 2026
en
GDPR for Australian Companies: Does It Apply to You?
When the GDPR reaches an Australian business under Art. 3(2), the two scope tests applied to Australian fact patterns, the Art. 27 EU representative duty, and what non-compliance costs.
Jul 30, 2026
en
GDPR for Canadian Companies: Does It Apply to You?
Canada's adequacy decision does not exempt Canadian companies from the GDPR. When Art. 3(2) applies, the Art. 27 EU representative duty, and what health data changes.
Jul 30, 2026
en
GDPR Compliance Software for Australian Companies (2026)
Buying guide for Australian companies subject to the GDPR: EU hosting, Art. 30 records, DSAR workflow, Art. 27 representative arrangements, and dual Privacy Act + GDPR record-keeping.
Jul 30, 2026
en
GDPR Compliance Software for Canadian Companies (2026)
Choosing GDPR compliance software in Canada: running Art. 30 records alongside PIPEDA and Quebec Law 25, bilingual output, three breach clocks, and what the market actually delivers.
Jul 30, 2026
en
GDPR Compliance Software for Indian Companies (2026)
GDPR software for Indian IT-services firms: Art. 30(2) processor records per client, sub-processor management, DPA and SCC registers, and audit evidence for European client due diligence.
Jul 30, 2026
en
GDPR Compliance Software for Singapore Companies (2026)
Buying guide for Singapore companies subject to the GDPR: EEA hosting, Art. 30 records for controller and processor activities, DSAR workflow, Art. 27 representative records, dual PDPA + GDPR registers.
Jul 30, 2026
en
GDPR for Healthcare Organisations: A Practical Guide
Health data needs an Art. 9(2) condition on top of an Art. 6 lawful basis. Controller mapping across providers, insurers and vendors, why consent fails in care, Art. 9(4) national law.
Jul 30, 2026
en
GDPR for Indian Companies: Scope and Obligations
Most Indian companies meet the GDPR as processors for European clients, not through Art. 3(2) targeting. What Arts. 28, 30(2), 32 and 33(2) require, and why health data is audited hardest.
Jul 30, 2026