3.3: Implementing GDPR Compliance

This is an important section as it will be useful in completing the assignment of preparing a GDPR implementation schedule.

As noted earlier, the GDPR applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the EU, regardless of whether the processing takes place in the Union or not. The GDPR applies to data controllers and processors outside the Union if they are engaged in offering goods and services to data subjects in the Union or are “monitoring the behavior of data subjects within the Union”.

Based on what the GDPR requires, what an organization needs to do is going to be based on an assessment of what the current state of compliance is and what needs to be done to achieve the desired level of compliance. This can be a self-assessment or one aided by external consultants who specialize in GDPR compliance.

Now that you have been able to read the actual text of relevant GDPR articles, let's start translating this into implementation.

Note

The EU Commission began considering proposed amendments and substantive changes to the GDPR in late 2025 as part of an omnibus reform to its data regulations, sparking considerable controversy. It is important for your implementation planning to ensure that you are working with the latest text of the Regulation, including any amendments the EU may have made. Additionally, it is worthwhile to include in your compliance plan any relevant contingencies your organization should take in the event the EU amends the GDPR in the future.

---