EU GDPR Compliance Consulting

The 7 principles of GDPR — what they mean in practice

GDPR is built on seven core principles that govern every aspect of how personal data must be handled. These are not aspirational — they are legal requirements, and supervisory authorities assess compliance against them directly.

For SMBs, the principles that create the most day-to-day compliance exposure are purpose limitation (not using data for purposes beyond what was disclosed), data minimization (only collecting what you genuinely need), and storage limitation (not retaining data longer than necessary). Together, these three principles account for a large proportion of the enforcement actions brought against smaller organizations.

Cyber-Management's GDPR compliance program maps your existing data processing activities against all seven principles, identifies where your current practices create exposure, and builds the policies and controls needed to bring you into conformity.

PRINCIPLE 1

Lawfulness, fairness & transparency

Processing must have a lawful basis, be fair to data subjects, and be transparent about how data is used.

PRINCIPLE 2

Purpose limitation

Data collected for one purpose cannot be used for a different, incompatible purpose without a new lawful basis.

PRINCIPLE 3

Data minimization

Only collect personal data that is adequate, relevant, and limited to what is necessary for the stated purpose.

PRINCIPLE 4

Accuracy

Personal data must be accurate and kept up to date. Inaccurate data must be erased or corrected without delay.

PRINCIPLE 5

Storage limitation

Personal data must not be kept longer than necessary for the purpose for which it was collected. Retention schedules are mandatory.

PRINCIPLE 6

Integrity & confidentiality

Data must be protected against unauthorized access, loss, or destruction using appropriate technical and organizational security measures.

PRINCIPLE 7

Accountability

Organizations must be able to demonstrate compliance — not just claim it. Documentation, policies, and records are the evidence of accountability.

The 6 lawful bases for processing personal data

Every processing activity in your organization must have one of six lawful bases.

Using the wrong one — or failing to identify one at all — is a fundamental GDPR violation.

The lawful basis you rely on also determines the rights your data subjects can exercise. Choosing the correct basis for each processing activity is therefore not just a legal formality — it shapes your entire data subject rights framework and your ability to defend enforcement actions. Cyber-Management's data mapping process identifies the appropriate lawful basis for every processing activity in your organization.

Article 6(1)(a)

Consent

The data subject has freely given, specific, informed, and unambiguous consent. Must be withdrawable at any time. Cannot be bundled with other terms. Most commonly over-relied upon by SMBs when another basis would be more appropriate.

Article 6(1)(b)

Contract

Processing is necessary to perform a contract with the data subject, or to take pre-contractual steps at their request. The most appropriate basis for processing customer and employee data related to service delivery.

Article 6(1)(c)

Legal obligation

Processing is required to comply with a legal obligation under EU or member state law — for example, retaining employee payroll records, or reporting to a regulator.

Article 6(1)(d)

Vital interests

Processing is necessary to protect someone's life. Narrow in application — primarily relevant in healthcare and emergency contexts.

Article 6(1)(e)

Public task

Processing is necessary for a task carried out in the public interest or in the exercise of official authority. Most relevant for public authorities and regulated bodies.

Article 6(1)(f)

Legitimate interests

Processing is necessary for the legitimate interests of the controller or a third party, provided these are not overridden by the data subject's interests or rights. Requires a documented Legitimate Interests Assessment (LIA). The most flexible basis — and the most frequently challenged by supervisory authorities.

Data subject rights — your obligations when individuals exercise them

GDPR gives EU residents eight enforceable rights over their personal data. Your organization must be operationally ready to respond to every one of them — typically within one calendar month.

The right to access (Subject Access Request) and the right to erasure (right to be forgotten) generate the most requests and the most enforcement activity for SMBs. Failing to respond within the one-month deadline — or failing to respond adequately — is a direct GDPR violation that supervisory authorities act on.

Cyber-Management builds the internal processes, response templates, and logging systems your team needs to handle data subject requests consistently and within deadline — regardless of volume.

72h

Breach notification deadline

Any personal data breach that poses a risk to individuals must be reported to your supervisory authority within 72 hours of becoming aware of it. Breaches affecting high-risk individuals must also be communicated directly to those individuals without undue delay. This timeline is non-negotiable — and most organizations that miss it do so because they lack a documented incident response procedure.

The 8 data subject rights under GDPR

Right of access (SAR)

Individuals can request a copy of all personal data held about them and information on how it is processed.

Right to rectification

Individuals can require inaccurate or incomplete personal data to be corrected.

Right to erasure

Individuals can request deletion of their data in certain circumstances — including when consent is withdrawn.

Right to restrict processing

Individuals can request that processing is limited while accuracy or lawfulness is contested.

Right to data portability

Individuals can obtain their data in a machine-readable format and transfer it to another provider.

Right to object

Individuals can object to processing based on legitimate interests or for direct marketing purposes.

Rights on automated decisions

Individuals have rights regarding decisions made solely by automated processing, including profiling, that significantly affects them.

Right to withdraw consent

Where consent is the lawful basis, individuals can withdraw it at any time — and this must be as easy as it was to give.

GDPR compliance roadmap for SMBs

GDPR compliance is not a one-time project — but it does have a clear starting structure.

Here is how Cyber-Management approaches it for a business that has not yet completed a formal GDPR program.

01 GDPR readiness assessment

A structured evaluation of your current data protection practices against GDPR requirements — identifying gaps, high-risk processing activities, and your most urgent remediation priorities.

02 Data mapping & Records of Processing

Building your Article 30 Records of Processing Activities (ROPA) — a complete inventory of every processing activity, its lawful basis, data categories, retention periods, and third-party recipients.

03 Policy & documentation build

Drafting or updating your Privacy Notice, Consent mechanisms, Data Subject Rights procedures, Breach Notification process, Data Retention Schedule, and Data Processor Agreements with third parties.

04 DPIA for high-risk processing

Conducting Data Protection Impact Assessments for any processing likely to result in high risk to individuals — mandatory under Article 35 for activities such as large-scale profiling, bio-metric data processing, or systematic monitoring.

05 Training & awareness

Delivering documented staff training on GDPR principles, data handling obligations, incident reporting, and data subject rights — satisfying the accountability requirements of Article 5(2).

06 Ongoing compliance & DPO support

Continuous monitoring of regulatory changes, annual GDPR audits, management of data subject requests, breach response support, and DPO as a Service where required or advisable.

How GDPR fits with ISO 27001, NIS2, and ISO 27701

GDPR does not operate in isolation. For most SMBs subject to multiple EU regulations, a joined-up approach that satisfies GDPR alongside ISO 27001 and NIS2 is significantly more efficient than three separate programs.

Framework	Relationship with GDPR	How they work together
ISO 27001	ISO 27001 directly addresses GDPR Article 32's requirement for "appropriate technical and organizational security measures" to protect personal data.	ISO 27001 certification provides demonstrable evidence of your security controls to supervisory authorities. A certified ISMS makes the security dimension of GDPR compliance significantly easier to evidence and defend.
NIS2	NIS2 and GDPR both require incident notification — NIS2 within 24 hours to the national authority, GDPR within 72 hours to the supervisory authority. Both require security risk management and documented controls.	Organizations subject to both can build a single incident response procedure that satisfies both notification timelines simultaneously, and a single risk management framework that addresses both sets of requirements.
ISO 27701	ISO 27701 is specifically designed as a privacy extension to ISO 27001 — it maps directly to GDPR requirements and provides a certifiable privacy management framework.	Organizations seeking to demonstrate comprehensive GDPR compliance through certification should consider ISO 27701 as the natural next step after ISO 27001. It adds the privacy governance layer that ISO 27001 alone does not cover.
DPO as a Service	GDPR requires certain organizations to appoint a Data Protection Officer — public bodies, organizations processing special categories at scale, and those conducting large-scale systematic monitoring	Cyber-Management's DPO as a Service provides a certified DPO on a fractional basis — satisfying the mandatory DPO requirement at a cost accessible to SMBs, with full accountability and independence as required by Article 38.

Why Choose Cyber-Management ?

Expertise in Cybersecurity and Compliance

Our team consists of seasoned professionals with extensive knowledge of GDPR and cybersecurity best practices.

Tailored Solutions

We understand that every business is unique. Our services are customized to meet your specific needs and challenges.

Focused on Small to Mid-Sized Businesses

We specialize in helping companies like yours navigate the complexities of GDPR without overwhelming your resources.

Not sure where your GDPR gaps are? Start with a free assessment call.

In 25 minutes we will identify your highest-risk processing activities, confirm whether you need a DPO, and outline the practical steps to reach a defensible compliance position — with no obligation to proceed.

Book a free consultation

GDPR compliance — Questions & Answers

Does GDPR apply to my business if we are based outside the EU?

Yes — GDPR has extraterritorial reach. Under Article 3, GDPR applies to any organization that processes personal data of EU residents in connection with offering goods or services to them, or monitoring their behaviour within the EU — regardless of where the organization is established. This means a US, UK, or Australian company that has EU customers or website visitors whose behaviour it tracks is subject to GDPR and must comply with its requirements, including appointing an EU representative in certain cases.

What is a DPIA and when is it mandatory?

A Data Protection Impact Assessment (DPIA) is a structured process for identifying and mitigating the privacy risks of a processing activity before it begins. Under GDPR Article 35, a DPIA is mandatory when processing is likely to result in a high risk to individuals' rights and freedoms — specifically for systematic and extensive profiling, large-scale processing of special categories of data (health, genetic, bio-metric, religious beliefs, etc.), and systematic monitoring of publicly accessible areas. Many supervisory authorities, including the CNIL in France, have published lists of processing activities for which a DPIA is always required in their jurisdiction.

Do we need a Data Protection Officer (DPO)?

Under GDPR Article 37, a DPO is mandatory for public authorities, organizations that carry out large-scale systematic monitoring of individuals, and organizations that process special categories of data at scale. Even where a DPO is not strictly mandatory, many SMBs appoint one voluntarily — either because clients or partners require it, or because the DPO role provides valuable ongoing GDPR oversight that reduces the risk of violations. Cyber-Management's DPO as a Service provides a certified, independent DPO at a fraction of the cost of a full-time hire.

What is the difference between a data controller and a data processor?

A data controller determines the purposes and means of processing personal data — they decide why and how data is processed. A data processor processes personal data on behalf of a controller — following the controller's instructions without determining the purpose themselves. Cloud providers, payroll bureaus, and marketing platforms are typical processors for an SMB. Both controllers and processors have GDPR obligations, but controllers bear primary accountability. If your organization acts as a processor for other businesses, you must have a Data Processing Agreement (DPA) in place with each controller you serve.

How long can we keep personal data under GDPR?

GDPR's storage limitation principle requires that personal data is not kept longer than necessary for the purpose for which it was collected. There is no single prescribed retention period — it depends on the type of data, the purpose of processing, and any applicable legal obligations (some national laws require data to be retained for specific periods, e.g. payroll records for tax purposes). Organizations must document their retention periods in a Retention Schedule and apply them consistently. Where a legal obligation requires longer retention than the original purpose would justify, the legal obligation lawful basis governs.

What should we do if we suffer a personal data breach?

First, contain the breach and preserve evidence. Second, assess the risk to individuals — is their data likely to result in harm (identity theft, discrimination, financial loss, reputational damage)? Third, if the breach poses a risk, notify your supervisory authority within 72 hours of becoming aware — in France this is the CNIL, via their online notification portal. Fourth, if the breach poses a high risk to individuals, notify those individuals directly without undue delay. Fifth, document everything — even breaches you decide not to report must be logged in your breach register under Article 33(5). Cyber-Management builds these procedures into your GDPR program so your team knows exactly what to do before a breach happens.

EU GDPR Compliance Services