(This question could be expanded to other auditing procedures too)

How do huge multinational companies that want to become GDPR compliant start off this? I mean, I guess one has to read the regulation, correct? But what if you misunderstood a point? Do companies usually call in an external party like an auditing company or consulting firm specialized in GDPR?

Say you read and understood all the necessary things to be GDPR compliant. You do the privacy impact assessment then implement features within your solution/product to achieve this (Eg: purge user data on demand, opt-in full cookies by default, don't have any "sign me up" box checked by default, etc).

Who then decides whether this set of features that should have been implemented is "complete" or not?

Do auditing firms or whoever says "You are compliant" offer some sort of insurance in case there's a lawsuit and the company has to pay for failing GDPR?

Or they just tell the company "The probability of paying in case of a GDPR lawsuit has been minimized"?

2 Answers 2


The GDPR consists largely of principles instead of concrete rules. It's possible to reasonably believe that you are fully compliant, but then have a court rule against you. Thus, a company might mitigate risks by getting experienced compliance consultants, and by not toeing the line of what is and isn't allowed. But at some point, working to reduce the remaining risk is not worth the effort. This will depend very much on the business. E.g. an adtech business will likely want to tolerate more risk than a bank.

As the interpretation of the GDPR evolves, compliance efforts must adapt. For example, the Schrems II judgement that invalidated the EU–US Privacy Shield shifted our understanding on the legality of international transfers. This judgement was not necessarily surprising for anyone who paid attention, so to some degree it was possible to prepare in advance. But that judgement was the kind of shift in jurisprudence where you can't fix your compliance by filling out one extra form, but rather have to rethink all international transfers of personal data – a blow to US SaaS providers and European SMEs that depend on them.

Some parts of the GDPR are geared to assist with a compliance process. For example, larger data controllers must create a Records of Processing Activities (ROPA) register. This lists all processing activities and their legal basis, which helps spotting potential compliance gaps. Risky processing activities require an Impact Assessment (DPIA) where the controller has to weigh different factors against each other and determine appropriate safeguards. While the GDPR doesn't necessarily say whether something is allowed or not, it frequently provides factors that must be considered in an analysis.

In addition to the GDPR itself, there's a lot of guidance available. Data protection authorities publish guidelines and can also be consulted directly. In fact, that's sometimes explicitly required. In the EDPB, the different authorities coordinate with each other and publish a series of EU-wide guidelines. Sometimes the subject is very specialized, sometimes the guidelines touch on a very general matter such as the concept of “consent”. These guidelines are an effectively–binding interpretation and thus bring welcome clarity to a compliance process.

  • So, short answer is no? Nov 12, 2021 at 2:50
  • 2
    The GDPR is like health and safety regulations for your company: There is no button you can push to be compliant now and forever. It is an ongoing process of educating your people on how to make good decisions and keep your business compliant. Just because you have no safety violations NOW does not mean that you won't have any in the future.
    – Frodyne
    Nov 12, 2021 at 8:12
  • 1
    @amon the problem is that GDPR doesn’t exist in a vacuum, it’s part of an ever growing number of regulations that are stifling business and innovation more and more every year. So you’ve got a billion here for GDPR, a billion there for some other initiative… and before you know it compliance costs are eating up a large chunk of the nations productive labor, especially if time spent on enforcement is counted as well. It’s considered to be the prime reason why US businesses are growing faster than European ones. Nov 12, 2021 at 9:17
  • 1
    @JonathanReez Sure, the comparatively lax regulatory environment in the US boosts economic growth – at the expense of externalized costs. The 1995 EU data protection law moved some data protection costs from the data subjects to the data controllers, and the 2016 GDPR upped the potential fines so that companies started paying attention. In any case, the EU isn't really concerned with costs for US companies for becoming compliant. That GDPR was passed indicates that the EU parliament considered it to be a good deal overall for its constituents, balancing basic rights and prosperity.
    – amon
    Nov 12, 2021 at 11:51
  • 1
    @amon There’s no data showing that said “externalized costs” are overall bigger than the benefit to the economy from lack of regulation. I.e. the combined externalities to the economy from not having good privacy laws are minuscule at best, as people who’s privacy is mismanaged still remain productive members of society. Nov 12, 2021 at 17:10

To add to the above, there are two entire complimentary fields known as Information Security and Data Protection that support this goal almost more than any other since the advent of GDPR.

Data Protection is usually seen as more strategic while Information Security deals with the underlying principles. Although they don't overlap entirely there is a fair amount that does.

There are near countless ways to become GDPR compliant and a number of different frameworks that support that compliance.

  • ISO27001
  • ISO27701
  • NIST SP 800 series
  • Cyber Essentials
  • Cyber Essentials+

All of these follow a structured approach to implementation, a larger company doesn't necessarily mean more difficult to implement although that is usually the case.

Like anything if there is an existing framework in place everyone is used to it'll take some time to re-do things, the more money is invested the quicker you can become compliant.

That said, I'm an Information Security Consultant and I've never seen a firm that's actually GDPR complaint. I've seen lots that can get through an audit and cover even most of the bases but, 100% compliance? No, doesn't remotely exist otherwise you wouldn't ever hear of people leaving laptops on trains or paperwork on a desk while a reporter walks past. So long as there are humans involved, people will make mistakes compliance will take a knock or two.

The important principle is firms are mostly compliant and have processes in place to address remediation of issues on an on-going basis.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .