GDPR compliance derived from your security assessment.
Eight years after it took effect, GDPR remains Europe's leading cause of audits and fines. It's also the first request from your B2B customers. Komplyo assesses your compliance article by article, generates the register and procedures, and derives Article 32 from the security measures you've already assessed.
What GDPR expects from an SME
Every organisation processing personal data is in scope. The concrete duties depend on your role and processing activities:
Controller
You decide the purposes: legal bases, informing data subjects, the register, security and oversight of your processors all fall directly on you.
Processor
You process on behalf of customers. Article 28 imposes contractual guarantees, a dedicated register and assistance duties. Frequently checked in due diligence.
DPO or internal lead
A Data Protection Officer is mandatory only in specific cases (large-scale regular and systematic monitoring, sensitive data). A trained, well-equipped internal lead is indispensable in every case.
GDPR duties, article by article
Komplyo assesses your compliance with a clear status (compliant, partial, missing) on the articles that matter:
Record of processing activities (Art. 30)
The first document requested by the supervisory authority and by your customers. Mandatory as soon as processing isn't occasional. In practice, almost always.
Security of processing (Art. 32)
"Appropriate" technical and organisational measures. Encryption, access control, backups, testing. Komplyo derives them from your security assessment. No duplicate questionnaire.
Data breaches (Art. 33-34)
Notification to the authority within 72 hours, informing individuals when the risk is high: you need a written procedure and a named owner before the incident.
Data-subject rights (Art. 15-22)
Access, rectification, erasure, portability, objection: processes to respond within one month, with identity verification.
Processors (Art. 28) and transfers (Ch. V)
Compliant contracts with your providers, safeguards for transfers outside the EU. The classic weak point of SaaS stacks.
Impact assessments (Art. 35)
A DPIA is required for high-risk processing: you must be able to identify those cases and document the analysis.
A privacy axis in its own right, with no duplicate entry
In Komplyo, GDPR isn't buried in a maturity score. It's a parallel compliance axis, assessed with a clear per-article status. And since security is assessed separately, Article 32 comes largely pre-filled from your NIST CSF 2.0 answers.
- 44 GDPR questions in business language, covering the security articles as well as data-subject rights.
- Per-article status (compliant, partial, missing). Visible at a glance in the dashboard.
- Automatic deduplication: a security measure you've already assessed feeds Article 32 with no extra question.
Your GDPR compliance documents
Generated from your answers, ready for an audit or a customer due diligence:
- Record of processing activities
- Data-breach management procedure (72 h)
- Data-subject rights procedure
- Data protection policy
- Prioritised action plan on the identified gaps
Further reading
Our practical guides on the topic:
Your first notification on ENISA's Single Reporting Platform: a CRA walkthrough for SMEs
ENISA's Single Reporting Platform has been open since 11 September 2026. An operational guide for an SME: create the account, pick the right CSIRT, fill in the 24-hour early warning, understand what becoming aware sets running, and what the platform does and does not do today.
Security awareness: a credible programme without budget or a dedicated team
An awareness programme holds together with a security representative who is short on time: one theme per month, short formats, free public resources (SensCyber, the Cybermoi/s kit, ENISA materials) and evidence of delivery. What NIS2, the AI Act and NIST CSF (PR.AT) require, and how to structure twelve months.
The AI Act on 2 August 2026: what actually applies and what is postponed for SMEs
2 August 2026 is the general application date of Regulation (EU) 2024/1689, but Regulation (EU) 2026/1744, published on 24 July 2026, postpones the Annex III high-risk obligations to 2 December 2027. A verified overview for SMEs: Article 50 transparency, AI content marking, postponed deadlines, penalties.
GDPR. Frequently asked questions
Is the record of processing activities mandatory for an SME?
The under-250-employee exemption only applies if processing is occasional, risk-free and involves no sensitive data. In practice, almost no company meets all three conditions. Treat the register as mandatory.
Do we need to appoint a DPO?
Only if you're a public body, or your core activity involves large-scale regular and systematic monitoring, or large-scale sensitive data. Otherwise a trained, well-equipped internal lead is enough. But you do need one.
What penalties can an SME face?
Up to €20M or 4% of worldwide annual turnover for the most serious breaches. Actual fines against SMEs are more modest but very real. The commercial cost of visible non-compliance (customers, tenders) usually arrives before the fine.
GDPR and NIS2. Do we need two programmes?
No. The security measures required by GDPR Article 32 and NIS2 Article 21 overlap heavily. Komplyo assesses them once and projects onto both, each keeping its own status.
Where is our assessment data hosted?
In the European Union (database in Frankfurt), as are the generated documents. A requirement we apply to ourselves before recommending it to you.
Does the free diagnostic cover GDPR?
Yes: 5 of the diagnostic's 23 questions address GDPR and give you a first status. The full assessment then goes deeper with the privacy axis's 44 questions.
Take stock of your GDPR position in minutes
The free diagnostic includes a first GDPR status. No account, no credit card, EU-hosted.