Your data management, under control
The GDPR (General Data Protection Regulation) governs how any organization processes personal data of people in the European Union. It has applied since May 25, 2018, with the same text across all 27 countries.
This guide summarizes the regulation in plain language and does not replace legal advice. Always check the official text before making decisions.
What the GDPR is
It applies to any organization that processes personal data of people in the EU, whether or not the company is established in Europe, and rests on three pillars. Each country complements it with its own law: in Spain, the Organic Data Protection Law (LOPDGDD), which covers everyday matters such as video surveillance, internal whistleblowing channels and employees’ digital rights.
Data subject rights
Access, rectification, erasure, objection, portability and restriction of processing, for anyone whose data is processed in the EU.
6 legal bases
Every processing activity needs a legal basis: consent, contract, legal obligation, vital interest, public interest or legitimate interest.
One authority per country
Each member state has its own data protection authority — in Spain, the AEPD — coordinated under the same regulation.
From the 1995 directive to the GDPR
01 / 1995
The earlier directive
Directive 95/46/EC lays the groundwork for data protection in the EU, but each country implements it differently.
02 / 2016
GDPR adopted
Regulation (EU) 2016/679 is adopted as a directly applicable regulation, not a directive to transpose.
03 / May 25, 2018
Full application
The GDPR becomes applicable across the EU, with the same text and the same maximum fines in all 27 countries.
€20M/4%
Maximum fine
72 hours
Deadline to report breaches
99
Articles
6
Legal bases
Sanctions
The GDPR defines two fine tiers based on the severity of the infringement. Each country’s authority applies the regulation with its own proportionality criteria.
| Category | Fine | Examples |
|---|---|---|
| Lower-tier infringements | Up to €10M or 2% of global turnover | Not keeping a record of processing activities, not reporting a breach on time, failing Article 32 security obligations. |
| Higher-tier infringements | Up to €20M or 4% of global turnover | Processing data without a legal basis, violating data subject rights, transferring data outside the EU without adequate safeguards. |
What ISO 27001 gives you for the GDPR
ISO 27001 helps with the security side of the GDPR, but it doesn’t cover all of it: the GDPR regulates legal and consent obligations that go beyond information security and that ISO 27001 doesn’t address. For that part there’s a dedicated privacy management standard, ISO/IEC 27701.
What it means for your SME
The GDPR has no size threshold: if your SME has web forms, a customer database, payroll, or uses analytics cookies, it is already processing personal data.
Many SMEs don’t need to appoint a Data Protection Officer (DPO), but it’s mandatory if you process sensitive data (such as health data) on a large scale or systematically monitor people. In Spain the law also requires one for schools, financial institutions, insurers, healthcare providers and private security companies, among others. If in doubt, confirm with legal counsel.
Privacy has to be built in by design: every new form, tool or vendor should collect only the data you need. And every vendor that processes data on your behalf needs a data processing agreement; in Kardu you store each one as evidence, dated and with its expiry.
If you also operate in Chile, its new data law is inspired by the GDPR, with differences of its own: Chile’s Law 21.719 vs GDPR.
7 minimum requirements
- A clear, accessible privacy policy
- A documented legal basis for each processing activity
- A Record of Processing Activities (RoPA)
- Data processing agreements (DPAs) with your vendors
- A breach protocol with a 72-hour deadline
- A channel for people to exercise their rights
- An impact assessment when processing is high risk (health data, biometrics, large-scale monitoring…)
Official sources
This guide is a summary. For the legal detail, consult the regulation’s text directly.
Official GDPR text on EUR-Lex →ISO 27001 as the base, GDPR included
Kardu organizes your compliance evidence around ISO 27001 and maps it to the GDPR and any other frameworks that apply to you, so you don’t duplicate work across regulations.