Compliance Framework
GDPR (General Data Protection Regulation)
The EU's data protection law — applies to any organization processing personal data of people in the EU, regardless of where the organization itself is based.
Who it applies to
Any business processing personal data of individuals in the EU/EEA, even if the business itself has no EU office — the trigger is whose data you handle, not where you're located.
What it requires
- —A documented lawful basis for every kind of personal data processing you do
- —Support for data subject rights: access, correction, deletion, and data portability requests within defined timeframes
- —Breach notification to the relevant authority, generally within 72 hours of becoming aware
- —Data protection built into system design from the start, not bolted on after ('privacy by design')
- —A Data Protection Officer for organizations meeting certain processing-scale thresholds
How we approach it
We map what personal data a system actually collects and why before building it, design deletion/export as real features (not an afterthought ticket), and structure logging so a breach notification can be answered factually and fast. We don't issue GDPR certification — no one can; GDPR compliance is a legal determination, and we build the technical controls a legal/compliance review depends on.
FAQs
Do we need to worry about GDPR if we're not based in the EU?
If you process personal data of anyone located in the EU — customers, users, even job applicants — GDPR can apply regardless of where your company is headquartered. Worth a specific legal read on your actual data flows rather than assuming it doesn't apply.
Have a project in mind?
Tell us what you're trying to automate or build — we'll reply with next steps, not a sales pitch.