The EU General Data Protection Regulation sets the global benchmark for data privacy. Non-compliance carries fines of up to 4% of global annual turnover or €20 million, whichever is higher.
What is GDPR?
The General Data Protection Regulation (GDPR) came into force on 25 May 2018 and applies to any organisation that processes the personal data of EU residents, regardless of where the organisation is based. The UK retained GDPR principles post-Brexit through the UK GDPR and Data Protection Act 2018.
GDPR is built on seven principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.
For UK organisations, compliance with UK GDPR is mandatory. For those operating in or serving EU markets, EU GDPR compliance is also required.
Compliance requirements
GDPR compliance is ongoing and covers technical, organisational, and legal obligations across your entire data processing landscape.
Every processing activity must have a valid lawful basis, consent, contract, legal obligation, vital interests, public task, or legitimate interests.
Organisations must honour rights including access, rectification, erasure, restriction, portability, and objection, with defined response timescales.
Data protection must be embedded into systems and processes from the outset, not bolted on. Default settings must be the most privacy-protective.
DPIAs are mandatory for high-risk processing activities, identifying and mitigating privacy risks before processing begins.
Personal data breaches must be reported to the relevant supervisory authority within 72 hours, and to affected individuals without undue delay where high risk.
Written contracts with all data processors are mandatory, setting out the subject matter, duration, nature, and purpose of processing.
Compliance process
GDPR compliance is not a one-time project. Netru builds a sustainable programme that evolves with your business.
We conduct a comprehensive data mapping exercise, identifying all personal data flows, processing activities, and third-party processors.
Your current practices are assessed against GDPR requirements, producing a prioritised remediation plan.
We draft or update your privacy notices, cookie policy, data retention policy, and internal data protection policies.
We build and maintain your Article 30 Records of Processing Activities (RoPA), a mandatory requirement for most organisations.
Technical and organisational measures are implemented, consent management, subject access request workflows, breach response procedures.
GDPR is not a one-time project. Netru provides ongoing support, annual reviews, and DPO-as-a-service to maintain compliance.
How Netru delivers it
We build GDPR programmes that work in practice, not just on paper. From data mapping to DPO-as-a-Service, Netru provides the expertise and ongoing support to keep you compliant.
Talk to our teamBefore you talk to anyone