GDPR compliance · GRC software
GDPR compliance for teams selling into Europe.
If you offer your product to people in the EU or track their behaviour, GDPR applies to you, wherever your company is based. AEGIS maps GDPR onto the same controls as ISO 27001, SOC 2 and India's DPDP Act, and keeps the evidence current as your product changes.
Every framework on every plan, priced by team size. You choose your auditor.
The basics
What is GDPR?
The General Data Protection Regulation (GDPR) is the EU's data protection law. It sets how organisations collect, use, store and share personal data of people in the EU, and gives those people rights over it. The UK applies its own near-identical version, the UK GDPR.
It reaches well beyond Europe. Under Article 3, a company with no EU office must comply if it offers goods or services to people in the EU or monitors their behaviour there. An Indian or US SaaS company with EU customers or users is usually in scope, either as a controller of its own users' data or as a processor for its customers.
Requirements
What GDPR asks for
GDPR is principle-based: it tells you what outcome to reach and expects you to prove it. These are the obligations most SaaS companies build for.
- Lawful basis and transparencyA lawful basis for each processing purpose, and a clear privacy notice that explains it.
- Data subject rightsAccess, correction, erasure, portability and objection, answered within one month.
- Security of processingAppropriate technical and organisational measures under Article 32, such as encryption, access control and testing.
- Breach notificationTell the supervisory authority within 72 hours of becoming aware, and affected people when the risk is high.
- Processors and DPAsA data processing agreement with every customer and subprocessor, and a public subprocessor list.
- Records and DPIAsA record of processing activities, and data protection impact assessments for high-risk processing.
- International transfersA valid transfer mechanism, such as adequacy or Standard Contractual Clauses, when EU data leaves the EU.
- AccountabilityPolicies, training, and a DPO or EU representative where the law requires one.
Explained
Is there a GDPR certification?
There is no mandatory GDPR certification. Article 42 allows approved certification schemes, such as the EU-wide Europrivacy seal, but they are voluntary and few companies hold one. You show compliance through your records, notices, DPAs, security measures and evidence.
In practice, EU buyers review your GDPR position alongside an ISO 27001 certificate or SOC 2 report for the security side. AEGIS keeps GDPR on the same control set as both, so one program answers them all.
Checklist
GDPR checklist
What an auditor or regulator will want to see. AEGIS generates each of these as a control, policy or evidence task, with an owner.
- Data map: which personal data you hold, where it lives, and why you process it.
- Lawful basis: a documented basis for every processing purpose.
- Privacy notice: a clear notice covering purposes, retention, rights and transfers.
- DPAs: signed agreements with customers and every subprocessor.
- Rights process: a way to receive, verify and answer requests within a month.
- Security measures: encryption, access control, logging and regular testing, with evidence.
- Breach plan: a tested process to assess a breach and notify within 72 hours.
- Transfers: Standard Contractual Clauses or another valid mechanism for data leaving the EU.
With AEGIS
Get GDPR ready, then stay ready.
Gets you compliant
From zero to ready
- A short security interview scopes GDPR for your company, with a reason for every control.
- Controls, policies, risk register and evidence backlog are generated in an afternoon.
- AI drafts each policy in your real context; a person on your team approves it.
- Evidence collects from your cloud, code, identity and devices.
Keeps you compliant
Current every day after
- Checks keep running and evidence keeps collecting after the audit.
- Access reviews, training and policy sign-offs come round on schedule, with owners.
- A control that drifts shows up before your next audit, and a check that cannot run never counts as a pass.
- GDPR shares one control set with every other framework, all included on every plan.
Your auditor, your choice
Pick the auditor that fits your buyers.
GDPR has no mandatory audit, but EU customers often ask for an independent view, usually an ISO 27001 certificate or a SOC 2 report that covers the security side, sometimes with a privacy assessment. You choose the firm, tier 1, 2 or 3, US-based or India-based, and AEGIS gives them read-only access to your evidence.
Works with Nexus Void
Security work that becomes GDPR evidence.
VAPT
Penetration testing
Article 32 expects a process for regularly testing and evaluating your security measures. A VAPT report is the usual evidence, and it files into AEGIS against that control.
Explore VAPTARGUS
Code security
Personal data leaks often start in code: an API that returns another user's profile, a hardcoded key, a vulnerable dependency. ARGUS finds them, maps every endpoint to the personal data it touches, and lists the third-party and AI services your code sends data to, which feeds your subprocessor list.
Explore ARGUSOther frameworks
One control set, every framework included.
FAQ
GDPR questions, answered
Answers to the questions teams ask us most. Updated 22 October 2026.
Still have questions? Contact us
Does GDPR apply to companies outside the EU?
Yes, if you offer goods or services to people in the EU or monitor their behaviour there, under Article 3. An Indian or US SaaS company with EU customers or users is usually in scope, and may also need an EU representative.
Does GDPR apply to Indian companies?
It does when they process personal data of people in the EU, for example as a SaaS vendor to EU customers or a processor for them. Indian companies often run GDPR alongside India's DPDP Act, and AEGIS keeps both on one control set.
Is there a GDPR certification?
Not a mandatory one. Article 42 allows voluntary certification schemes such as Europrivacy, but most companies show compliance through records, DPAs, notices and security evidence, often backed by ISO 27001 or SOC 2.
How fast must a GDPR breach be reported?
To the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to put people at risk. Affected individuals must be told without undue delay when the risk to them is high.
What are the GDPR fines?
Up to €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious breaches, and up to €10 million or 2% for others. Regulators also order changes and processing bans.
GDPR or DPDP: what is the difference?
Both protect personal data and share ideas such as notice, consent and rights. GDPR offers six lawful bases and stricter transfer rules; India's DPDP Act relies mainly on consent and a short list of legitimate uses. AEGIS supports both on one control set.
How much does GDPR compliance cost?
With AEGIS, GDPR is included on every plan, priced by team size rather than per framework. Legal advice on lawful bases or transfers, or an independent assessment, is billed by the firm you choose.
GDPR with AEGIS
Get GDPR ready, and keep it that way.
Tell us who is asking for it and we will show you the path, and which auditors fit.