GDPR

What it is

The GDPR governs how personal data about people in the EU is collected, used, shared, stored and deleted. It applies to companies established in the EU and to companies anywhere in the world that offer goods or services to people in the EU or monitor their behaviour. In the Netherlands it is supplemented by the UAVG and supervised by the Autoriteit Persoonsgegevens.

This applies to you if

• You have customers, users, employees or candidates in the EU, wherever your company is based
• You run analytics, advertising, CRM, HR or support tooling that holds names, emails, IDs or behaviour
• You use AI tools, cloud providers or vendors that process personal data on your behalf
• You transfer data to the US or other countries outside the EEA

What it asks of you

1. A lawful basis and a stated purpose for each processing activity
2. A record of processing activities (RoPA) and, for high-risk processing, a DPIA
3. Processor agreements (Art. 28) with every vendor that handles personal data
4. Transparency notices, and working processes for access, erasure and objection requests
5. Breach notification to the regulator within 72 hours, and to affected people when the risk is high
6. A data protection officer in some cases, and a transfer mechanism for non-EEA data flows

How we help

Not sure which apply to you? Send us three lines about what you sell and to whom, and we will tell you which rules matter and which do not.

• Privacy & GDPR
• AI governance & EU AI Act
• Technology & commercial contracts