GDPR | ayedo

What is the GDPR?

Regulation (EU) 2016/679 (General Data Protection Regulation) is the central data protection law of the EU. Goal: protection of fundamental rights of natural persons and free movement of data within the EU. Directly applicable since 25 May 2018.

Scope & Application

The GDPR applies territorially and extraterritorially – to all organizations within the EU and to non-EU organizations that process data of EU citizens or monitor their behavior.

EU Organizations

All companies/authorities within the EU

As soon as personal data is processed – regardless of size, sector or type of processing. From micro-enterprises to corporations. No thresholds.

Extraterritorial Application

Non-EU organizations processing EU data

Companies based outside the EU are also subject to GDPR if they offer goods/services to EU citizens or monitor their behavior (e.g. tracking, profiling).

Exceptions

Purely personal activities excluded

Private use of social media, household correspondence. Law enforcement falls under Directive (EU) 2016/680. National security also excluded.

Personal Data

All information about identified/identifiable person

Name, email, IP address, cookie IDs, biometric data, location data, online identifiers. Also indirectly identifiable data (pseudonyms with reference).

The 7 Fundamental Principles (Art. 5)

The GDPR anchors seven fundamental principles for any data processing. These form the basis of all requirements and must be demonstrably complied with at all times.

Lawfulness, Fairness, Transparency

Data only on lawful basis

Consent, contract, legal obligation, vital interests, public task or legitimate interest
Processing fair and transparent to data subjects
Clear information about purposes

Purpose Limitation

Use only for defined purposes

Data collected for specified, explicit and legitimate purposes
Further processing only if compatible with original purpose
Purpose change requires new legal basis or consent

Data Minimization

Collect only necessary data

Data must be adequate, relevant and limited to what is necessary for the purpose
No "collection in advance"
What is not needed is not collected

Accuracy

Keep data current and correct

All reasonable measures to erase or rectify inaccurate data
Data subjects can request rectification
Systems for data quality management required

Storage Limitation

Store only as long as necessary

Identifiable form only as long as required for purposes
Then: anonymization, pseudonymization or deletion
Document retention concepts and periods

Integrity & Confidentiality

Technical/organizational measures

Protection against unauthorized/unlawful processing, loss, destruction, damage
Encryption, access controls, backup, monitoring
Appropriateness to risk

Accountability

Obligation to demonstrate compliance

Controller must be able to demonstrate at any time that all principles are being followed
Documentation, policies, audits, reviews
Burden of proof on controller

Rights of Data Subjects

The GDPR strengthens individual control rights over personal data. Data subjects can request access, rectification, erasure, restriction, data portability and object – organizations must actively enable these rights.

Right of Access (Art. 15)

Right to know what data is stored

Data subjects may request information about: what categories of data, for what purposes, to which recipients, storage period, source of data
Free copy of data
Response within 1 month

Right to Rectification (Art. 16)

Correction of inaccurate data

Data subjects can request immediate rectification of inaccurate personal data
Completion of incomplete data
Notification of all recipients about rectification

Right to Erasure (Art. 17)

"Right to be forgotten"

Erasure when: purpose fulfilled, consent withdrawn, objection raised, unlawful processing, legal erasure obligation
Exceptions: legal retention obligations, defense rights, public interest

Right to Restriction (Art. 18)

Freeze processing instead of erasing

When accuracy contested, unlawful processing (but data subject refuses erasure), or during review of objection
Data may only be stored, not actively processed

Right to Data Portability (Art. 20)

Export in machine-readable format

Data subjects can receive their data in structured, commonly used, machine-readable format
Direct transfer to another controller where technically feasible
Applies to automatically processed data based on consent/contract

Right to Object (Art. 21)

Object based on particular situation

Against processing based on legitimate interest or public task
Against direct marketing (absolute right to object)
Controller must cease processing unless compelling legitimate grounds override

Automated Decisions (Art. 22)

Protection from purely algorithmic decisions

Right not to be subject to solely automated decision (including profiling) that produces legal effects or significantly affects
Exceptions: contract, law, explicit consent
Human review

Controller Obligations

Organizations processing personal data bear comprehensive responsibility. From Privacy by Design to security measures to documentation obligations – the GDPR demands proactive compliance.

Privacy by Design & Default (Art. 25)

Data protection built-in, not bolted-on

Technical/organizational measures already in design/development
Data minimization, pseudonymization, encryption as standard
Privacy-by-default: only necessary data by default, minimal storage period, limited accessibility

Security of Processing (Art. 32)

State-of-the-art technical/organizational measures

Encryption (at rest, in transit), pseudonymization, access controls
Availability/resilience, recoverability
Regular tests/audits
Appropriateness: risk, state of art, costs

Records of Processing Activities (Art. 30)

Documentation of all processing

Name/contact of controller, purposes, categories of data subjects/data, recipients
Third-country transfers, retention periods, security measures
Exception: <250 employees (with limitations)
Present to supervisor on request

Data Protection Impact Assessment (Art. 35)

DPIA mandatory for high risk

Systematic evaluation, extensive processing of special categories, public monitoring
Automated decisions with legal effect, new technologies
Content: description, necessity/proportionality, risk assessment, mitigation measures
Prior consultation with supervisor if residual risk

Data Breach Notification (Art. 33/34)

72-hour notification to supervisor

For breach of confidentiality, integrity, availability of personal data
Description, categories/number of affected, consequences, measures
Notification to data subjects for high risk (without undue delay)
Exceptions: encryption, subsequent measures

Processing Agreement (Art. 28)

DPA for data processing by third parties

Processor only on documented instructions
Contract with: subject, duration, nature/purpose, data categories, controller obligations/rights
Security measures, sub-processors, support obligations
Deletion/return after end

International Data Transfers (Chapter V)

Transfer of personal data outside the EU/EEA is subject to strict requirements. Goal: ensure equivalent data protection level also in third countries.

Adequacy Decision

EU Commission confirms protection level

For certain countries (e.g. UK, Switzerland, Japan, Israel) Commission has found adequate data protection level
Transfer possible as within EU
Regular review
EU-US Data Privacy Framework since July 2023

Standard Contractual Clauses (SCCs)

Commission-approved contract clauses

Standard Contractual Clauses (2021/914) as transfer instrument
Controller-to-processor, controller-to-controller, processor-to-processor
Transfer Impact Assessment (TIA) additionally required
Additional measures for third-country access

Binding Corporate Rules (BCRs)

Group-internal data protection rules

For multinational corporate groups
Approval by lead supervisory authority required
Binding rules for entire group
Enforceable rights for data subjects
Complex approval procedure

Other Safeguards & Derogations

Specific situations

Derogations: explicit consent, contract performance, legal claims, vital interests, public interest, public registers
Codes of conduct, certification as safeguards possible
Ad-hoc approval by supervisor

ayedo and GDPR

Our Software Delivery Platform is GDPR-native designed – from Privacy by Design to EU data residency to comprehensive data subject rights mechanisms. Data protection is not a compliance checkbox, but an architecture principle.

Privacy by Design & Default

Data protection built-in

Modular, data-minimized architectures
Logical isolation of personal data
Pseudonymization/anonymization where possible
Privacy-by-default configurations
Infrastructure-as-code with privacy patterns
No "data collection in advance"

EU Data Residency & Sovereignty

Exclusively EU data centers

Germany as primary region
EU-based infrastructure providers
No third-country transfers in standard setup
GDPR Art. 44-50 compliant
EU jurisdiction, EU law, EU supervision
Full control over data flows

State-of-the-Art Security (Art. 32)

Encryption throughout

TLS 1.3+ for data in transit, encryption at rest
Customer-managed keys (BYOK/BYOHSM)
Access controls (RBAC/ABAC), MFA, PAM
Regular vulnerability scans
ISO 27001-certified processes
Audit logs for all access

Standard DPA

GDPR-compliant processing agreement

Standardized Data Processing Agreements
Clear role separation (controller/processor)
Documented instructions, sub-processor lists, security measures
Support for data subject rights
Deletion/return after contract end
EU SCCs where required

Records of Processing Activities

Art. 30-compliant documentation

Complete processing register internally
Customer-specific processing documentation on request
Categories: data, data subjects, purposes, recipients, retention periods, security measures
Audit-ready

Data Subject Rights Support

APIs & processes for access/erasure/export

Self-service portals for data export (Art. 20 data portability)
Structured, machine-readable formats
Erasure/restriction mechanisms
Response within GDPR deadlines (1 month)
Technical support for customers with data subject requests

Incident Response & Breach Notification

72h reporting process established

Structured incident response playbooks
Breach detection mechanisms
Forensic analysis capability
Coordination with customers (controller) for data breaches
Template notifications for supervisory authorities
Post-incident reviews, lessons learned

Data Protection Officer & Governance

Dedicated DPO & privacy team

Internal Data Protection Officer
Data protection as part of our Integrated Management System (IMS)
Regular privacy audits, training
Data protection impact assessments for new services
Continuous compliance monitoring

ISO Certifications

External audits & evidence

ISO 9001 (Quality Management) and ISO 27001 (Information Security Management) certified
Regular external audits by accredited certification bodies
Compliance attestations for customers
Certificates available on request

Kostenlose Beratung

GDPR in Regulatory Context

The GDPR is the foundation of European digital regulation. All other EU regulations (Data Act, NIS-2, DORA, CRA) build on it or complement it for specific areas.

GDPR & Data Act

Data Act builds on GDPR

GDPR regulates data protection, Data Act regulates data access/use. Both together: protection AND availability. Data Act data access must not violate GDPR – legal bases, DPIAs required. Anonymization/pseudonymization as bridge.

More about Data Act

GDPR & NIS-2

Complementary: data protection & cybersecurity

GDPR protects personal data, NIS-2 protects network/information systems. Overlaps: Art. 32 GDPR (security) ↔ NIS-2 risk management. Incident reporting in parallel (GDPR → DPA, NIS-2 → CSIRT). Integrated compliance required.

More about NIS-2

GDPR & DORA

GDPR as basis for financial sector

DORA specifies ICT resilience, GDPR remains applicable for data protection. DORA ICT third-party risk includes GDPR processing agreements. Incident reporting coordinated (DORA → financial supervisor, GDPR → DPA). DORA compliance requires GDPR compliance.

More about DORA

GDPR & Cyber Resilience Act

Product security meets data protection

CRA requires secure products (software, hardware), GDPR requires data protection in their use. Privacy by Design (GDPR Art. 25) ↔ Security by Design (CRA). Vulnerability management (CRA) supports Art. 32 GDPR.

More about CRA

GDPR & Cloud Sovereignty

Data protection as sovereignty enabler

EU data residency, customer key sovereignty, exit capability address GDPR requirements (Art. 32, Art. 44-50). Cloud Sovereignty Framework evaluates GDPR compliance as core factor. EU-only stacks = GDPR-native.

More about the Framework

ayedo Compliance Overview

Comprehensive compliance approach

How ayedo systematically addresses GDPR, Data Act, NIS-2, DORA, CRA. Certifications, processes, technical measures. Integrated compliance roadmap. Audit readiness. Complete documentation.

To overview

Sanctions & Enforcement

The GDPR enables significant fines and strengthens supervisory authorities with comprehensive powers. Non-compliance can be existential – from financial penalties to reputation damage.

Fine Tiers

Two sanction tiers. Tier 1 (up to €10M or 2% global annual turnover): formal violations (missing documentation, no DPO, no DPIA). Tier 2 (up to €20M or 4% turnover): substantive violations (violation of data subject rights, unlawful processing, missing legal basis).

Authority Powers

Comprehensive supervisory power. Investigations, access to premises/systems, document requests, interviews. Warnings, orders, processing bans, certification withdrawal. Urgency procedures for serious violations. Public announcement of violations.

Civil Liability

Compensation claims by data subjects. Material AND immaterial damage (Art. 82). Litigation option for data subjects. Class actions through consumer organizations possible. Burden of proof reversed: controller must prove absence of fault. Insurance for GDPR violations established.

One-Stop-Shop Principle

Lead supervisory authority for cross-border processing. Main establishment determines lead supervisor. Coordination via EDPB (European Data Protection Board). Complaints possible to any supervisor. Consistency mechanism for disagreements. Simplification for multinational companies.

GDPR Data Protection as a Fundamental Right