GDPR Compliance Guide (2026): Scope, Obligations, Fines and the Digital Omnibus

Who it applies to

• EU-established controllers and processors, wherever the processing happens.
• Non-EU organizations targeting or monitoring people in the EU (Art. 3). These organizations usually also need an EU representative.
• Both roles carry obligations. Controllers decide why and how data is processed, while processors process on a controller's behalf. Processors have direct duties too, including their own records, security, notifying breaches to the controller, and restrictions on using sub-processors (Art. 28).

Key requirements

Principles (Article 5)

Personal data must be:

• processed lawfully, fairly and transparently
• collected for specified, explicit purposes (purpose limitation)
• minimized
• accurate
• kept no longer than necessary (storage limitation)
• kept secure (integrity and confidentiality)

The controller "shall be responsible for, and be able to demonstrate compliance with" these principles. This is accountability (Art. 5).

Lawful basis (Article 6)

There are six lawful bases: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Public authorities can't rely on legitimate interests when performing their tasks (Art. 6). Record which basis you rely on for each purpose.

Transparency and data subject rights (Article 12)

Information and communications must be "concise, transparent, intelligible and easily accessible". Respond to rights requests (Articles 15–22) "without undue delay and in any event within one month". You can extend this by two further months for complex or numerous requests, but you must tell the person within the first month (Art. 12).

Records of processing (Article 30)

Controllers record:

• the purposes of processing
• categories of data subjects and data
• recipients
• international transfers
• retention periods
• a general description of security measures

Processors keep their own records. The exemption for organizations with fewer than 250 employees is narrow. It doesn't apply if the processing is likely to create a risk, is more than occasional, or involves special-category or criminal-offence data (Art. 30). In practice, most organizations need records.

DPIAs (Article 35)

You must carry out a DPIA before processing that is "likely to result in a high risk", in particular:

• systematic, extensive profiling with legal or similarly significant effects
• large-scale processing of special-category or criminal data
• large-scale systematic monitoring of public areas

Supervisory authorities also publish their own lists (Art. 35).

Data Protection Officer (Article 37)

A DPO is mandatory for:

• public authorities
• organizations whose core activities involve large-scale regular and systematic monitoring
• organizations whose core activities involve large-scale special-category or criminal data

A group can appoint a single DPO if they're easily accessible from each establishment (Art. 37).

Processors (Article 28)

Use only processors that give "sufficient guarantees". Contracts must cover documented instructions, confidentiality, security, sub-processor authorization (with notice of changes and a right to object), assistance with rights and DPIAs, deletion or return of data, and audits (Art. 28).

International transfers (Article 44)

Transfers outside the EEA are allowed only under the Chapter V mechanisms, such as adequacy decisions, appropriate safeguards like SCCs or BCRs, or derogations. Onward transfers count too (Art. 44).

Breach notification

Document every breach, including ones you don't notify.

Certification

There's no mandatory GDPR certificate. Article 42 certification schemes and Article 40 codes of conduct are voluntary ways to demonstrate compliance. Organizations usually show GDPR readiness through records, DPIAs, contracts, and audits such as ISO/IEC 27701 or ISO/IEC 27001.

Penalties

Fines must be "effective, proportionate and dissuasive", and supervisory authorities weigh factors such as gravity, intent, mitigation and cooperation (Art. 83). There are two tiers:

• Up to €10m or 2% of worldwide turnover. Breaches of controller and processor obligations under Articles 8, 11, 25–39, 42 and 43, such as records, security, breach notification, DPIAs and DPOs.
• Up to €20m or 4%. Breaches of the principles, lawful basis, consent, data subject rights, international transfers, or supervisory authority orders.

Individuals can also claim compensation, and authorities can order processing to stop.

Digital Omnibus: what's changing (status October 2026)

The European Commission proposed the Digital Omnibus in November 2025. On 22 October 2026, IAPP reported that the Council had agreed its negotiating mandate (IAPP). The mandate:

• keeps the current Article 4(1) definition of personal data, rejecting the Commission's narrowing
• adds pseudonymization standards
• adds safeguards that allow sensitive data to be used for biometric verification and AI model training, plus clarifications on lawful grounds for AI training
• changes ePrivacy cookie consent exemptions, covering service provision, audience measurement and device security
• prefers national incident-reporting entry points over a single EU portal

Trilogue starts once Parliament agrees its position. Until then, keep complying with the current GDPR.

Mapping to related frameworks

• UK GDPR: a near-identical baseline, as amended by the UK's Data (Use and Access) Act 2025.
• ISO/IEC 27001 / 27701: security of processing and evidence of a privacy management system.
• NIST Privacy Framework: a governance structure for privacy risk.
• EU AI Act: overlaps on DPIAs and fundamental-rights impact assessments for high-risk AI.
• CCPA, LGPD, PDPA: similar rights and processor contract concepts.

Readiness checklist

1. Map your data and build Article 30 records.
2. Assign and document a lawful basis for each purpose, and run legitimate-interest assessments where you rely on that basis.
3. Update privacy notices to meet Articles 13–14 and Article 12's plain-language standard.
4. Set up a rights-request workflow with a one-month deadline tracker.
5. Screen processing for DPIA triggers and complete DPIAs before launch.
6. Decide whether you need a DPO, and an EU representative if you're based outside the EU.
7. Put Article 28-compliant DPAs in place and keep a sub-processor register.
8. Inventory transfers and record the mechanism for each, with transfer impact assessments.
9. Implement Article 32 security and test incident response against the 72-hour clock.
10. Train staff, and review the program each year and when the Digital Omnibus outcome lands.

Common pitfalls

• Treating consent as the default lawful basis.
• Assuming the under-250 exemption removes the need for records.
• Skipping DPIAs for AI and profiling projects.
• Missing the 72-hour clock because "awareness" isn't defined internally.
• Outdated sub-processor lists.
• Acting on Digital Omnibus proposals before they're adopted.

How AssureCore helps

AssureCore's Policy Management, with AI-assisted writing and gap analysis, helps you draft privacy policies. The Risk Register tracks DPIA risks with action plans, Evidence Management (with expiry alerts) holds DPAs and records, and Cross-framework Mapping links GDPR to ISO 27001 and other frameworks.

Frequently asked questions

Official references

• GDPR Art. 3 – Territorial scope
• GDPR Art. 5 – Principles
• GDPR Art. 6 – Lawfulness of processing
• GDPR Art. 12 – Transparency and rights modalities
• GDPR Art. 28 – Processor
• GDPR Art. 30 – Records of processing
• GDPR Art. 33 – Breach notification to authority
• GDPR Art. 34 – Communication to data subjects
• GDPR Art. 35 – DPIA
• GDPR Art. 37 – Designation of DPO
• GDPR Art. 44 – Transfers
• GDPR Art. 83 – Administrative fines
• GDPR Art. 99 – Entry into force and application
• IAPP – EU member states finalize Digital Omnibus negotiating stance (22 Oct 2026)

Related frameworks

• UK GDPR guide
• CCPA guide
• LGPD guide
• NIST Privacy guide