Compliance tools · Cybersecurity and data protection

GDPR compliance tool

Regulation (EU) 2016/679 · European Union · Binding instrument

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your GDPR documentation cited article by article. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report

GDPR is Regulation (EU) 2016/679, a binding instrument in the European Union. Personal data processing obligations for businesses established in the EU and for those outside it that offer goods or services to, or monitor, people in the Union.

The free assessment screens for GDPR when a business handles personal data through an EU establishment or about people in the Union.

Screen your business against all 116 agent toolkits, free →

• Your exact position under GDPR: what is in place, what is missing, and what to do about each gap.
• Documentation with article citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the regulation requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that GDPR applies to your business, free →

Does GDPR apply to my business?

The GDPR applies to you if you process personal data and you are a controller or processor established in the European Union, or you are outside it but offer goods or services to people in the Union or monitor their behaviour there (Article 3(2)).

Who does GDPR apply to?

It applies to controllers and processors established in the Union, to controllers and processors outside the Union that target or monitor data subjects in the Union, and to the natural persons whose personal data are processed.

Does GDPR apply to a small business?

There is no general size threshold, but organisations with fewer than 250 employees have a derogation from record-keeping obligations (Article 30(5)), and Recital 13 encourages supervisory authorities to take account of the needs of micro, small and medium-sized enterprises.

When does GDPR apply from, and what are the deadlines?

It entered into force on the twentieth day following publication (Article 99(1)) and has applied from 25 May 2018 (Article 99(2)). Processing already under way on that date had to be brought into conformity within two years after entry into force (Recital 171).

What does GDPR require me to do?

You must follow the six data protection principles and be able to demonstrate compliance (Article 5(2), Article 24(1)), give privacy notices (Article 13(1)), handle data subject rights (Article 12(2)), run a DPIA for high-risk processing (Article 35(1)), and notify breaches within 72 hours (Article 33(1)).

What records or documents does GDPR require me to keep or produce?

You must keep controller records of processing (Article 30(1)), processor records of processing (Article 30(2)), breach documentation (Article 33(5)), consent records, and transfer assessment documentation, and make records available to the supervisory authority on request (Article 30(4)).

What happens if I do not comply with GDPR?

Lower tier fines reach EUR 10,000,000 or 2 per cent of total worldwide annual turnover, whichever is higher (Article 83(4)), and upper tier fines reach EUR 20,000,000 or 4 per cent of that turnover (Article 83(5)-(6)). Supervisory authorities may also issue reprimands and corrective measures, and individuals may claim compensation (Article 82(1)).

Does GDPR apply to a UK business selling into the EU?

Yes. A business outside the Union that offers goods or services to data subjects in the Union or monitors their behaviour within the Union is covered (Article 3(2)), and it must designate a representative in the Union in writing (Article 27(1)).

Does GDPR apply to an EU business selling into the UK?

Yes. A controller or processor established in the Union is covered, and the regulation applies across the European Union to processing of personal data (Article 2(1)).

How is GDPR different from ePrivacy Directive?

The GDPR applies to matters not subject to specific obligations in the ePrivacy Directive (Article 95), and it does not impose additional obligations on persons already subject to specific obligations with the same objective under that Directive (Article 95).

How do I start complying with GDPR?

Start with accountability: adopt appropriate technical and organisational measures, reviewed and updated where necessary, and adopt data protection policies where proportionate (Article 24(1), Article 24(2)).

Which ComplianceSME account includes the GDPR toolkit?

The GDPR agent toolkit is free with the Start account.

Related in cybersecurity and data protection: ePrivacy Directive · NIS2 Directive · CER Directive · DORA