GDPR

What is GDPR?

The GDPR has applied since May 2018. It covers organizations established in the EU, and organizations elsewhere that offer goods or services to people in the EU or monitor their behavior; the UK applies an equivalent UK GDPR. It rests on seven principles: lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. It sets rules on lawful processing, transparency, data subject rights, security, international transfers and breach notification. It is not a certificate: compliance is something you demonstrate continuously, through records, contracts and controls.

Who needs it

• Any startup with EU users, customers or employees
• US companies selling into Europe
• B2B vendors that process personal data on behalf of their customers

What usually triggers it

• A customer asks you to sign a data processing agreement (DPA)
• You move data between the EU and other countries
• A due diligence or investor review covers data protection

How the process works

1. Map what personal data you hold, where and why
2. Set legal bases, retention and records of processing
3. Put DPAs in place with customers and sub-processors
4. Implement security measures and a breach response process
5. Keep the program current as your product changes

How Holam helps

We work out whether GDPR is what your customers actually need, and in what order alongside other frameworks. We then introduce you to a compliance platform and specialists that fit your stage, and stay involved until the result is in your hands. Holam receives a referral fee from providers we introduce when you engage them. You pay the provider directly, we add nothing to their price, and you remain free to choose another provider.

Frequently asked questions