# When should an expanding company consider GDPR?

> Entering a European market does not answer every privacy question. Start with the people served, the processing activities and your role in each data flow.

Canonical page: https://assurelane.ai/en/frameworks/gdpr/
Updated: 2026-09-26 · Sources checked: 2026-09-26

## At a glance

- Full name: General Data Protection Regulation (EU) 2016/679
- Issuer: EU/EEA data protection authorities
- Output: Ongoing legal obligations; no official “GDPR certificate”
- Applies to: Organisations established in the EU, or offering goods/services to or monitoring people in the EU
- Region: EU / EEA (UK GDPR in the UK)
- Typical timeline: A baseline programme commonly takes 2–4 months
- Validity: Ongoing; update when processing changes

## Key dates

- 2018-05-25: GDPR applies
- 2021-06: New Standard Contractual Clauses adopted
- 2023-07: EU–US Data Privacy Framework adequacy decision

## First question: are the activities in scope?

The GDPR can apply to processing connected to an establishment in the EU. It can also apply to a company outside the EU when it offers goods or services to individuals in the EU or monitors their behaviour there. Assess the **specific processing and audience**; server location, place of incorporation and the existence of a European customer do not settle the question alone. A customer who happens to use an otherwise untargeted service while travelling in the EU does not automatically create the same case.

| Situation | What to establish first |
| --- | --- |
| A China-based SaaS team actively markets to people in the EU | Who is targeted, how is the service offered, and what personal data is collected? |
| A B2B provider handles data supplied by a European customer | Who decides the purposes and means, and what do the contract and instructions say? |
| A site or app uses tracking tools | Who is tracked, for which purposes, and who receives the data? |
| A buyer asks for “GDPR compliance” in a questionnaire | Which service, data and contractual commitments does the question cover? |

These are screening examples. Other national or US state privacy rules require their own assessment; GDPR is not a synonym for global privacy compliance.

## Map the data before making a promise

Separate product, website and customer delivery flows. Record where data comes from, why it is collected, where it is held, who can access it, where it is shared and when it is deleted. Include analytics SDKs, email tools, cloud providers and support systems. Then establish the company's role in each activity and compare actual practice with customer terms and public notices.

For international transfers, first identify the origin, destination, parties and proposed mechanism. Signing standard contractual clauses is not a universal answer to every processing issue. A qualified specialist should assess whether a particular arrangement is needed and how it applies to the real flow.

## What to prepare for an initial review

1. Target markets, intended users and how the service reaches them.
2. Product and website data fields, purposes, storage locations and retention periods.
3. Entities, vendors, SDKs and transfer paths involved.
4. Existing privacy notices, customer data terms and access records.
5. The buyer's exact wording, requested evidence and deadline.

An initial discussion needs a process summary, not complete user datasets or sensitive contracts uploaded through a public inquiry channel.

## Roles and outcomes

The company owns its processing activities, product settings and contractual promises. A preparation specialist can map data and gaps; qualified privacy or legal professionals assess the applicable law and duties. GDPR is not a generic certification. A SOC 2 report or ISO/IEC 27001 certificate does not by itself replace privacy analysis.

If the immediate task is a buyer security questionnaire, establish whether it asks for control evidence, contract terms or a legal position. Each calls for different material.

## Common mistakes

- **“We are outside Europe, so GDPR cannot apply.”** Targeted services or monitoring of people in the EU can still bring processing into scope.
- **“Our site opens in Europe, so we need a full GDPR project.”** Accessibility alone does not determine targeting or processing scope.
- **“A security certificate proves privacy compliance.”** Security controls matter, but processing grounds, notices, rights and contracts need separate assessment.

## Sources

- [EUR-Lex — GDPR full text (Article 3, territorial scope)](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [European Commission — GDPR principles](https://commission.europa.eu/law/law-topic/data-protection/information-business-and-organisations/principles-gdpr_en)
- [European Commission — Standard contractual clauses Q&A](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/new-standard-contractual-clauses-questions-and-answers-overview_en)

---
General information only; not legal, audit or certification advice. AssureLane does not issue SOC 2 reports or ISO certificates.